439565 - [@ nsDragSession::invokeDragSessionWithImage] crashes app with non-document node

Status: RESOLVED FIXED

(Core :: DOM: Copy & Paste and Drag & Drop, defect)

Description

[Peter van Hardenberg]

STR:
1) Find some drag and drop code to hack in.
2) Create a new element to pass in as the image parameter to invokeDragSessionWithImage. I used something like: var element = document.createElement("div");
3) Change the call to .invokeDragSession to .invokeDragSessionWithImage. You will need to add four new parameters, an nsIDOMNode, two offset numbers, and the event. (See the docs for nsIDragSession.)
4) Execute the code by dragging an appropriate node.

Result:
Crash! (See pastebin url.)

Desired result:
Ideally, a rendered node, but barring that at least the default outline frame and no crash.

Work around:
Stick the node into a document or document fragment. If you put it in a document fragment you'll get a blank, empty-frame drag box. If you put it in a document, you get expected behaviour.

Comment 1

[timeless]

please don't use pastebin when filing bugs. use "add an attachment" or include the attachment when filing.

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/base/nsPresShell.cpp&rev=3.1116&mark=5129,5131#5113

my guess is that GetStartParent returned null.
Process:         songbird [8902]
Path:            /Users/pvh/Development/songbird/compiled/dist/Songbird.app/Contents/MacOS/songbird
Identifier:      org.songbirdnest.songbird
Version:         0.7pre (0.7pre)
Code Type:       X86 (Native)
Parent Process:  bash [196]

Date/Time:       2008-06-16 17:33:38.699 -0700
OS Version:      Mac OS X 10.5.3 (9D34)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000008
Crashed Thread:  0

Thread 0 Crashed:
0   XUL                           	0x02bf9699 nsINode::IsInDoc() const + 9 (nsINode.h:264)
1   XUL                           	0x02bfc48d nsINode::GetCurrentDoc() const + 17 (nsINode.h:275)
2   XUL                           	0x01ef913c PresShell::CreateRangePaintInfo(nsIDOMRange*, nsRect&) + 164 (nsPresShell.cpp:5131)
3   XUL                           	0x01f0474a PresShell::RenderNode(nsIDOMNode*, nsIRegion*, nsPoint&, nsRect*) + 162 (nsPresShell.cpp:5312)
4   XUL                           	0x0286a540 nsBaseDragService::DrawDrag(nsIDOMNode*, nsIScriptableRegion*, int, int, nsRect*, gfxASurface**, nsPresContext**) + 1522 (nsBaseDragService.cpp:473)
5   XUL                           	0x0281e1c8 nsDragService::ConstructDragImage(nsIDOMNode*, nsRect*, nsIScriptableRegion*) + 846 (nsDragService.mm:177)
6   XUL                           	0x0281ea20 nsDragService::InvokeDragSession(nsIDOMNode*, nsISupportsArray*, nsIScriptableRegion*, unsigned int) + 570 (nsDragService.mm:268)
7   XUL                           	0x02869612 nsBaseDragService::InvokeDragSessionWithImage(nsIDOMNode*, nsISupportsArray*, nsIScriptableRegion*, unsigned int, nsIDOMNode*, int, int, nsIDOMMouseEvent*) + 334 (nsBaseDragService.cpp:256)
8   XUL                           	0x02937756 NS_InvokeByIndex_P + 98 (xptcinvoke_unixish_x86.cpp:179)
9   XUL                           	0x01cc63a7 XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 6167 (xpcwrappednative.cpp:2388)
10  XUL                           	0x01ccdf52 XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, long*) + 398 (xpcwrappednativejsops.cpp:1473)
11  libmozjs.dylib                	0x0198fbfa js_Invoke + 2591 (jsinterp.c:1296)
12  libmozjs.dylib                	0x01982c13 js_Interpret + 61888 (jsinterp.c:4851)
13  libmozjs.dylib                	0x0198fc6f js_Invoke + 2708 (jsinterp.c:1312)
14  libmozjs.dylib                	0x0198ff2f js_InternalInvoke + 134 (jsinterp.c:1368)
15  libmozjs.dylib                	0x0192fcf4 JS_CallFunctionValue + 136 (jsapi.c:5054)
16  XUL                           	0x022f610e nsJSContext::CallEventHandler(nsISupports*, void*, void*, nsIArray*, nsIVariant**) + 1336 (nsJSEnvironment.cpp:1962)

Comment 2

[Neil Deakin]

Attachment: null check the node

Comment 3

[Neil Deakin]

Bug 454324 suggests that we should fix this for 1.9.0 as well. Very safe node-is-in-a-document patch.

Comment 4

[Samuel Sidler (old account; do not CC)]

Comment on attachment 335534 [details] [diff] [review]
null check the node

Not blocking, but this patch is approved for 1.9.0.4. Please land in CVS. a=ss for release-drivers

Comment 5

[Al Billings [:abillings - ex-MoCo]]

Peter, can you verify that this is fixed using a 1.9.0.4 nightly from ftp://ftp.mozilla.org/pub/firefox/nightly/latest-mozilla1.9.0/? I can't easily follow your steps to reproduce the original issue.