Crash with contentReadOnly, forwardDelete

RESOLVED FIXED in mozilla16

Status

()

Core
Editor
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: ayg)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
mozilla16
crash, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

5 years ago
Created attachment 634688 [details]
testcase (crashes Firefox when loaded)

Messy testcase.  I guess some state is not visible to serializeDOMAsScript :/
(Reporter)

Comment 1

5 years ago
Created attachment 634689 [details]
stack trace
(Reporter)

Comment 2

5 years ago
bp-2d8d05cf-c567-4651-ba1c-46b302120620
Crash Signature: [@ nsEditor::CreateTxnForDeleteInsertionPoint ]
Aryeh, can you please take a look?
Assignee: nobody → ayg
Status: NEW → ASSIGNED
This was bug 762183 part 4.  It added a while loop to change selectedNode's value, but didn't account for the fact that it might set it to null.  Just need a null check here.
Blocks: 762183
Created attachment 634809 [details] [diff] [review]
Patch v1

https://tbpl.mozilla.org/?tree=Try&rev=dc65bbdb8a0d
Attachment #634809 - Flags: review?(ehsan)

Comment 6

5 years ago
On Windows: bp-591d4a60-3df4-4f94-8c9f-12fb72120620.
Crash Signature: [@ nsEditor::CreateTxnForDeleteInsertionPoint ] → [@ nsEditor::CreateTxnForDeleteInsertionPoint ] [@ nsEditor::CreateTxnForDeleteInsertionPoint(nsRange*, short, EditAggregateTxn*, nsINode**, int*, int*) ]
OS: Mac OS X → All
Hardware: x86_64 → All
Attachment #634809 - Flags: review?(ehsan) → review+

Comment 7

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/60a0cc699002
Target Milestone: --- → mozilla16

Comment 8

5 years ago
https://hg.mozilla.org/mozilla-central/rev/60a0cc699002
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.