Closed Bug 842132 Opened 11 years ago Closed 11 years ago

Crash with contentEditable, selection.deleteFromDocument with overlapping selection ranges

Categories

(Core :: DOM: Selection, defect)

Product:
Core
Component:
DOM: Selection
Version:
21 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox20 --- unaffected
firefox21 --- fixed

People

(Reporter: jruderman, Assigned: smaug)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(4 files)

testcase
541 bytes, application/xhtml+xml
Details
stack (gdb)
11.19 KB, text/plain
Details
patch
2.02 KB, patch
tbsaunde
: review+
Details | Diff | Splinter Review
patch
3.47 KB, patch
Details | Diff | Splinter Review
Attached file testcase — 
Regression from bug 841706?
Attached file stack (gdb) — 
[@ nsFrameSelection::DeleteFromDocument]
On Windows: bp-9211abf3-9353-4811-9a58-83f2d2130217
Crash Signature: [@ nsFrameSelection::DeleteFromDocument() ]
status-firefox20: --- → unaffected
status-firefox21: --- → affected
OS: Mac OS X → All
Hardware: x86_64 → All
Version: Trunk → 21 Branch
Attached patch patch — — Splinter Review 
Assignee: nobody → bugs

        Attachment #714943 -
        Flags: review?(trev.saunders)

    
    

    
  
Comment on attachment 714943 [details] [diff] [review]
patch

I guess this fine to bring fix the crash and keep old behavior for this release.

It would be nice if you  made the test case into a test.

thanks for working on this!

        Attachment #714943 -
        Flags: review?(trev.saunders) → review+

    
    

    
  
I'll push the test as a crash test if that works... testing.

    
    

    
  

      
      
      
      

        Attached patch
          
          
        patch
        — 
          — Splinter Review
      

    


  

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/645cb4fbf390
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED

    
    

    
  
Backed out for build bustage.
https://hg.mozilla.org/mozilla-central/rev/4514f27f41ff

https://tbpl.mozilla.org/php/getParsedLog.php?id=19845950&tree=Firefox

cc1plus: warnings being treated as errors
../../../../editor/libeditor/base/nsEditor.cpp: In member function 'nsresult nsEditor::CreateTxnForDeleteSelection(nsIEditor::EDirection, EditAggregateTxn**, nsINode**, int32_t*, int32_t*)':
../../../../editor/libeditor/base/nsEditor.cpp:4569:67: error: comparison between signed and unsigned integer expressions
make[7]: *** [nsEditor.o] Error 1
Status: RESOLVED → REOPENED
Resolution: FIXED → ---

    
    

    
  
Maybe this works.
https://hg.mozilla.org/mozilla-central/rev/148ea95584b4
Status: REOPENED → RESOLVED
Closed: 11 years ago → 11 years ago
Resolution: --- → FIXED

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: