622596 - Firefox 3.5.16 Crash Report [@ nsTypedSelection::ContainsNode(nsIDOMNode*, int, int*) ]

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[Carsten Book [:Tomcat]]

Running Mz's fuzzer on 3.5.16 caused a crash in @ nsTypedSelection::ContainsNode(nsIDOMNode*, int, int*)

http://crash-stats.mozilla.com/report/index/b7ad94d8-b87a-40e8-a680-4c1cd2110103

need to find the url for the testcase

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsTypedSelection::ContainsNode 	layout/generic/nsSelection.cpp:6064
1 	xul.dll 	nsCOMPtr_base::~nsCOMPtr_base 	obj-firefox/xpcom/build/nsCOMPtr.cpp:81
2 	xul.dll 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:2456

Comment 1

[Daniel Veditz [:dveditz]]

null dereference, but does that stack make sense?

Comment 2

[chris hofmann]

lets put all the cross_fuzz bugs as blocking on bug 581539 for now.

Comment 3

[chris hofmann]

so far this looks like only 3.5.16 Windows NT 6.1.7600, and maybe all three reports are tomcat.

nsTypedSelection::ContainsNode(nsIDOMNode*, int, int*) 3.5.16 Windows NT 6.1.7600 
http://lcamtuf.coredump.cx/cross_fuzz/targets/target.html CrashCat
 http://crash-stats.mozilla.com/report/index/83f5a97c-2fb3-4df2-99cd-3f0732110103

nsTypedSelection::ContainsNode(nsIDOMNode*, int, int*) 3.5.16 Windows NT 6.1.7600 
http://lcamtuf.coredump.cx/cross_fuzz/targets/target.html crashcat windows 7
 http://crash-stats.mozilla.com/report/index/b7ad94d8-b87a-40e8-a680-4c1cd2110103

nsTypedSelection::ContainsNode(nsIDOMNode*, int, int*) 3.5.16 Windows NT 6.1.7600 
wyciwyg://19/http://lcamtuf.coredump.cx/cross_fuzz/cross_fuzz_randomized_20100729_seed.html CrashCat
 http://crash-stats.mozilla.com/report/index/3431aead-bcab-4590-802b-1d3302110103

Comment 4

[Carsten Book [:Tomcat]]

(In reply to comment #3)
> so far this looks like only 3.5.16 Windows NT 6.1.7600, and maybe all three
> reports are tomcat.
> 

yeah all 3 were from me - just look at crashcat at the user comments. i use "crashcat" there to identify my crashes

Comment 5

[Bob Clary [:bc] (inactive)]

I reproduced this on 32bit linux with seed -1992972524

Comment 6

[Bob Clary [:bc] (inactive)]

Attachment: testcase

t2 = window.open();
t2.document.documentElement.childNodes.item(undefined).contentEditable = true;
t2.getSelection().containsNode([], false);

I reduced this on mac, fwiw.

Comment 7

[David Bolter [:davidb] (NeedInfo me for attention)]

I think this is fixed but haven't narrowed down when.

Comment 8

[Mats Palmgren (inactive)]

WFM in recent Nightly builds on Linux64, OSX and Win7.  Also in local ASan debug
build on Linux64.  I don't see any reports matching "nsTypedSelection::ContainsNode"
in the past 4 weeks on crash-stats, in any version.

Comment 9

[Mats Palmgren (inactive)]

Landed a crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b8efd7688256

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b8efd7688256