Last Comment Bug 771749 - Crash [@ nsEditor::RemoveContainer]
: Crash [@ nsEditor::RemoveContainer]
Status: RESOLVED FIXED
: crash, regression, testcase
Product: Core
Classification: Components
Component: Editor (show other bugs)
: 16 Branch
: All All
: -- critical (vote)
: mozilla16
Assigned To: :Aryeh Gregor (working until September 2)
:
Mentors:
Depends on:
Blocks: 336383 756750
  Show dependency treegraph
 
Reported: 2012-07-06 20:44 PDT by Jesse Ruderman
Modified: 2012-09-18 23:22 PDT (History)
5 users (show)
ayg: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected
+
fixed


Attachments
testcase (requires focus) (421 bytes, text/html)
2012-07-06 20:44 PDT, Jesse Ruderman
no flags Details
stack trace (gdb) (13.74 KB, text/plain)
2012-07-06 20:44 PDT, Jesse Ruderman
no flags Details
Patch (2.22 KB, patch)
2012-07-08 03:58 PDT, :Aryeh Gregor (working until September 2)
ehsan: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2012-07-06 20:44:04 PDT
Created attachment 639918 [details]
testcase (requires focus)

Probably a regression in 4b1249ae1906:6d7fae9764b3
Comment 1 Jesse Ruderman 2012-07-06 20:44:19 PDT
Created attachment 639919 [details]
stack trace (gdb)
Comment 2 :Aryeh Gregor (working until September 2) 2012-07-08 03:46:22 PDT
This is a regression from bug 756750:

-  nsCOMPtr<nsIDOMNode> child;
-  while (bHasMoreChildren)
-  {
-    inNode->GetLastChild(getter_AddRefs(child));
-    res = DeleteNode(child);
-    NS_ENSURE_SUCCESS(res, res);
-    res = InsertNode(child, parent, offset);
+  while (aNode->HasChildren()) {
+    nsIContent* child = aNode->GetLastChild();
+    nsresult rv = DeleteNode(child->AsDOMNode());
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = InsertNode(child->AsDOMNode(), parent->AsDOMNode(), offset);

If you assign a node to nsIContent* and then remove it from its parent, it is not wise to try to dereference the pointer afterwards.
Comment 3 :Aryeh Gregor (working until September 2) 2012-07-08 03:58:55 PDT
Created attachment 640047 [details] [diff] [review]
Patch

Try: https://tbpl.mozilla.org/?tree=Try&rev=46387258d3c6
Comment 4 :Aryeh Gregor (working until September 2) 2012-07-10 00:47:40 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/519bc7e30a7b
Comment 5 Ryan VanderMeulen [:RyanVM] 2012-07-10 15:47:20 PDT
https://hg.mozilla.org/mozilla-central/rev/519bc7e30a7b
Comment 6 Paul Silaghi, QA [:pauly] 2012-09-18 07:26:07 PDT
(In reply to Jesse Ruderman from comment #0)
> Created attachment 639918 [details]
> testcase (requires focus)
> 
> Probably a regression in 4b1249ae1906:6d7fae9764b3

Not able to reproduce on nightly 2012-07-06. Any ideas ?
Comment 7 Jesse Ruderman 2012-09-18 17:43:48 PDT
Try a debug or ASan build?  It's a pointer lifetime bug (causing a use-after-free) so it's not guaranteed to crash, especially in nightly builds.
Comment 8 Paul Silaghi, QA [:pauly] 2012-09-18 23:22:04 PDT
Already tried the debug build and no success. I can't find older ASan builds, could you please point me to them?

Note You need to log in before you can comment on or make changes to this bug.