Last Comment Bug 713417 - Crash [@ nsIRange::UnregisterCommonAncestor] with designMode
: Crash [@ nsIRange::UnregisterCommonAncestor] with designMode
Status: VERIFIED FIXED
[inbound][qa!]
: crash, testcase, verified-beta
Product: Core
Classification: Components
Component: DOM (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla12
Assigned To: Mats Palmgren (:mats)
:
Mentors:
Depends on:
Blocks: 594645
  Show dependency treegraph
 
Reported: 2011-12-24 19:01 PST by Jesse Ruderman
Modified: 2012-03-26 23:27 PDT (History)
7 users (show)
mats: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected
unaffected
verified
verified


Attachments
testcase (crashes Firefox when closed) (340 bytes, text/html)
2011-12-24 19:01 PST, Jesse Ruderman
no flags Details
stack trace (15.86 KB, text/plain)
2011-12-24 19:01 PST, Jesse Ruderman
no flags Details
fix (891 bytes, patch)
2011-12-26 02:00 PST, Mats Palmgren (:mats)
bugs: review+
christian: approval‑mozilla‑aurora+
Details | Diff | Splinter Review
Jesse's test (729 bytes, patch)
2011-12-26 02:01 PST, Mats Palmgren (:mats)
no flags Details | Diff | Splinter Review
Another crash test (1.26 KB, patch)
2011-12-26 02:04 PST, Mats Palmgren (:mats)
no flags Details | Diff | Splinter Review

Description Jesse Ruderman 2011-12-24 19:01:27 PST
Created attachment 584240 [details]
testcase (crashes Firefox when closed)

1. Load the testcase.
2. Close the tab or quit Firefox.

Result: Crash [@ nsIRange::UnregisterCommonAncestor]
Comment 1 Jesse Ruderman 2011-12-24 19:01:44 PST
Created attachment 584241 [details]
stack trace
Comment 2 Mats Palmgren (:mats) 2011-12-26 02:00:59 PST
Created attachment 584315 [details] [diff] [review]
fix

Make the nsGkAtoms::range property transferable otherwise it's deleted by adoptNode.
Comment 3 Mats Palmgren (:mats) 2011-12-26 02:01:37 PST
Created attachment 584316 [details] [diff] [review]
Jesse's test
Comment 4 Mats Palmgren (:mats) 2011-12-26 02:04:10 PST
Created attachment 584317 [details] [diff] [review]
Another crash test

A similar test that crashes without using document.designMode
Comment 5 Olli Pettay [:smaug] 2011-12-26 04:27:56 PST
Comment on attachment 584315 [details] [diff] [review]
fix

Ah, of course.

The patch should go to Aurora too, right?
Comment 7 Mats Palmgren (:mats) 2011-12-26 05:35:39 PST
Comment on attachment 584315 [details] [diff] [review]
fix

> The patch should go to Aurora too, right?

Yes.  It's a low-risk crash fix.
Comment 9 christian 2011-12-27 14:46:37 PST
Comment on attachment 584315 [details] [diff] [review]
fix

[triage comment]
Approved for aurora. Simple crash fix.
Comment 11 Paul Silaghi, QA [:pauly] 2012-02-07 05:04:47 PST
No crashes loading the test case from comment 0. This is verified fixed on Firefox 11b1:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Mozilla/5.0 (X11; Linux x86_64; rv:11.0) Gecko/20100101 Firefox/11.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0
Comment 12 Paul Silaghi, QA [:pauly] 2012-03-23 03:27:59 PDT
No crashes loading the test case from comment 0. This is verified fixed on Firefox 12b2:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Mozilla/5.0 (X11; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20100101 Firefox/12.0
Comment 13 Paul Silaghi, QA [:pauly] 2012-03-23 03:29:45 PDT
I cannot duplicate the tab with the test case. Could be something related to this fix ?
Comment 14 Jesse Ruderman 2012-03-23 11:03:42 PDT
Paul, what do you mean by "duplicate the tab"?
Comment 15 Paul Silaghi, QA [:pauly] 2012-03-26 00:07:44 PDT
http://www.technospot.net/blogs/how-to-duplicate-firefox-3-tabs/
Comment 16 Jesse Ruderman 2012-03-26 12:53:19 PDT
Paul, that's related to http://hg.mozilla.org/mozilla-central/annotate/a30fd69f1e0c/browser/components/sessionstore/src/nsSessionStore.js#l2193, not this patch. Can you file a new bug report in the "Session Restore" component, and mention the bug number here?
Comment 17 Paul Silaghi, QA [:pauly] 2012-03-26 23:27:35 PDT
Sure Jesse.
Bug 739531 filed.

Note You need to log in before you can comment on or make changes to this bug.