Closed Bug 766413 Opened 9 years ago Closed 9 years ago

Crash with contentReadOnly, forwardDelete

Categories

(Core :: DOM: Editor, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla16

People

(Reporter: jruderman, Assigned: ayg)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(3 files)

Messy testcase.  I guess some state is not visible to serializeDOMAsScript :/
Attached file stack trace
bp-2d8d05cf-c567-4651-ba1c-46b302120620
Crash Signature: [@ nsEditor::CreateTxnForDeleteInsertionPoint ]
Aryeh, can you please take a look?
Assignee: nobody → ayg
Status: NEW → ASSIGNED
This was bug 762183 part 4.  It added a while loop to change selectedNode's value, but didn't account for the fact that it might set it to null.  Just need a null check here.
Blocks: 762183
On Windows: bp-591d4a60-3df4-4f94-8c9f-12fb72120620.
Crash Signature: [@ nsEditor::CreateTxnForDeleteInsertionPoint ] → [@ nsEditor::CreateTxnForDeleteInsertionPoint ] [@ nsEditor::CreateTxnForDeleteInsertionPoint(nsRange*, short, EditAggregateTxn*, nsINode**, int*, int*) ]
OS: Mac OS X → All
Hardware: x86_64 → All
Attachment #634809 - Flags: review?(ehsan) → review+
https://hg.mozilla.org/mozilla-central/rev/60a0cc699002
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.