448445 - Crash when copying or dragging content within an html <ul> element [@ nsHTMLContentSerializer::IsFirstChildOfOL(nsIDOMElement*) ]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[7842.9]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/2008072903 Minefield/3.1a2pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/2008072903 Minefield/3.1a2pre

Crashes when dragging a link inside an html <ul> element. Tested in a new profile.

Reproducible: Always

Steps to Reproduce:
1. Open url
2. Drag link
3. Crash instantly.
Actual Results:  
Crash

Expected Results:  
Not crash

Crash report
http://crash-stats.mozilla.com/report/index/3856080c-5d97-11dd-beab-001a4bd43ef6

Another from mozillazine forum user gigaherz, probably the same bug
http://crash-stats.mozilla.com/report/index/94481bab-5d9c-11dd-aaa7-001cc4e2bf68
posted here: http://forums.mozillazine.org/viewtopic.php?p=4012435#p4012435

Comment 1

[u88484]

Confirming, I believe this regressed since yesterday's (2008072803) nightly because I tried to reproduce on that first to no avail, upgraded to today's and could reproduce.

Comment 2

[John]

Attachment: Reduced Testcase

Comment 3

[David Quintana]

(In reply to comment #0)
> Another from mozillazine forum user gigaherz, probably the same bug
> http://crash-stats.mozilla.com/report/index/94481bab-5d9c-11dd-aaa7-001cc4e2bf68
> posted here: http://forums.mozillazine.org/viewtopic.php?p=4012435#p4012435
> 

Just to say I'm gigaherz from mozillazile, and add myself to CC.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a2pre) Gecko/2008072903 Minefield/3.1a2pre ID:2008072903

Comment 5

[philippe (part-time)]

Regression rang from bug 448464
regressed between 
Gecko/2008072822 Minefield/3.1a2pre (works)
Gecko/2008072823 Minefield/3.1a2pre (fails)
(OS X builds)

Comment 6

[u88484]

Broke between 2008072822 and 2008072901 windows builds

From dependent bug:
regressed between 
Gecko/2008072822 Minefield/3.1a2pre (works)
Gecko/2008072823 Minefield/3.1a2pre (fails)
(OS X builds)

Comment 8

[u88484]

So now double-clicking links also.  Seems to keep getting worse with more ways to trigger this.

Comment 9

[Luke Schlather]

Actually, I noticed it primarily on the body of elements. Try:
http://news.slashdot.org/article.pl?sid=08/07/29/2211235
And double click on the body of a comment without links.

Comment 10

[Jesse Ruderman]

Breakpad is broken, but I'm guessing this is a topcrash.

Comment 11

[Misak Khachatryan]

Mozilla/5.0 (X11; U; Linux i686; rv:1.9.0.2pre) Gecko/2008072213 SeaMonkey/2.0a1pre ID:2008072213

Mine works ok. No crash

P.S My build id seems wrong by another Seamonkey bug, it's 30 jul gecko 1.9.1 latest build

Comment 12

[Robert Stopp (textrinum)]

This happens also designmode.

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

Peter, I think this is a regression from bug 332239, which added the aOriginalElement parameter. That parameter is quite often null, so referencing it
may cause crashes.

Comment 14

[Joseph W Becher]

Adding:

476194e1-5e45-11dd-b31c-001a4bd43ef6	7/30/2008	10:39 AM
2d795868-5e45-11dd-862a-001a4bd43ef6	7/30/2008	10:38 AM

Mine occurs on http://www.kelvinluck.com/assets/jquery/datePicker/v2/demo/documentation.html

When trying to copy the example code under dpSetStartDate

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/2008073003 Minefield/3.1a2pre ID:2008073003

Comment 15

[Peter Van der Beken [:peterv]]

(In reply to comment #13)
> Peter, I think this is a regression from bug 332239, which added the
> aOriginalElement parameter.

Nope, I think this is actually a regression from bug 293834.

Comment 16

[Ben Karel [eschew]]

Yeah, this mess is my fault. The fix should be pretty simple: if aOriginalNode is null, use aNode instead. Verifying now, will be a few minutes for the compile to finish.

Comment 17

[Ben Karel [eschew]]

Attachment: Fix missing case of !aOriginalNode && !mNodeFixup

Verified that this fixes the crash on OS X.

Comment 18

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 331759 [details] [diff] [review]
Fix missing case of !aOriginalNode && !mNodeFixup

r+sr=bzbarsky

Comment 19

[Boris Zbarsky [:bzbarsky]]

Pushed changeset b57a468b13a2.  It'd be good to have a test here.

Comment 20

[u88484]

Verified fixed with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/2008073014 Minefield/3.1a2pre