499006 - Null pointer crash [@ nsINode::GetNodeParent] in [@ nsContentUtils::ComparePoints] using detach()'ed DOM range

Status: RESOLVED WORKSFORME

(Core :: DOM: Selection, defect)

Description

[Mats Palmgren (inactive)]

Attachment: Testcase (CRASHES on load)

Loading the attached testcase crashes Firefox trunk.
It doesn't crash 1.9.1 or 1.9.0 builds for me.  (all on Linux x86-64)

Comment 1

[Mats Palmgren (inactive)]

Attachment: stack

The range was GC'ed ?

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase2

This seems like the same issue, except it seems to have a different regression range and different stacktrace, namely not.

Comment 3

[Daniel Veditz [:dveditz]]

Martijn: are you filing testcase2 as a separate bug then?

Comment 4

[Brandon Sterne (:bsterne)]

Neither testcase crashes Firefox 3.6, Firefox 3.5.7, or a trunk debug build for me (on Linux).  dveditz, any reason to keep this one open still?

Comment 5

[Mats Palmgren (inactive)]

It appears to have been fixed in the range 2009-10-05-03 -- 2009-10-06-03:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1470fa9c9f01&tochange=8f1ba5c38bb1
Bug 520070 is in that range and the attached crash stack looks similar
to the one in that bug.

We should land the crashtests in this bug when bug 520070 is made public.

Comment 6

[Mats Palmgren (inactive)]

Attachment: crashtests.diff

Comment 7

[Mats Palmgren (inactive)]

Landed crashtests:  http://hg.mozilla.org/mozilla-central/rev/09336169ed68

I think we can make this bug public now.