529670 - Crash [@ nsINode::GetCurrentDoc] after range.detach and then using getClientRects

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build on load. I guess this is a regression from bug 396392.

http://crash-stats.mozilla.com/report/index/941771d1-1ccf-4760-a1dc-251ab2091118
0	xul.dll	nsINode::GetCurrentDoc
1	xul.dll	GetPresShell
2	xul.dll	nsRange::GetClientRects
3	xul.dll	NS_InvokeByIndex_P
4	xul.dll	XPCWrappedNative::CallMethod
5	xul.dll	XPC_WN_CallMethod
6	mozjs.dll	js_Invoke
7	mozjs.dll	js_Interpret
8	mozjs.dll	js_Execute
9	mozjs.dll	JS_EvaluateUCScriptForPrincipals
10	xul.dll	nsJSContext::EvaluateString
11	xul.dll	nsScriptLoader::EvaluateScript
12	xul.dll	nsScriptLoader::ProcessRequest
13	xul.dll	nsScriptLoader::ProcessScriptElement

Comment 1

[Mats Palmgren (inactive)]

I was just about to file this, it's currently #88 on the 1.9.3 top crash list.
http://crash-stats.mozilla.com/query/query?version=ALL%3AALL&platform=windows&branch=1.9.3&date=&range_value=1&range_unit=weeks&query_search=signature&query_type=exact&query=&do_query=1

It also crashes when the boundary point is a Document node (not nsIContent).

Patch coming up...

Comment 2

[Mats Palmgren (inactive)]

Attachment: Testcase #2

Comment 3

[Timothy Nikkel (:tnikkel)]

(In reply to comment #1)
> It also crashes when the boundary point is a Document node (not nsIContent).

That would probably be bug 529411.

Comment 4

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

Yes, this fixes both bugs.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 413256 [details] [diff] [review]
Patch rev. 1

tests?

Comment 6

[Mats Palmgren (inactive)]

Will push Testcase #2 as crash test, it covers both bugs.
mozilla-central checkins are restricted now though...

Comment 7

[Boris Zbarsky [:bzbarsky]]

Can we push this, please?

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

The patch needs to be refreshed, it doesn't apply cleanly for me.

Comment 9

[Mats Palmgren (inactive)]

Attachment: Updated to tip

I'll land this tomorrow when I have time to watch the tree...

Comment 10

[Mats Palmgren (inactive)]

http://hg.mozilla.org/mozilla-central/rev/6a13910dde03