Closed Bug 850198 Opened 13 years ago Closed 13 years ago

crash in nsCopySupport::FireClipboardEvent when pasting

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
22 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla22
Tracking Flags:
Tracking Status
firefox21 --- unaffected
firefox22 + fixed

People

(Reporter: metasieben, Assigned: enndeakin)

References

Details

(4 keywords)

Crash Data

Attachments

(1 file)

Fix crash
4.64 KB, patch
smaug
: review+
Details | Diff | Splinter Review
i'm getting a crash whenever i paste something into an input-field(location-bar/textarea/input). https://crash-stats.mozilla.com/report/index/bp-b8039968-6bad-4128-abe4-3601e2130312
I can't reproduce on Windows. Here are the first frames of the stack trace: Frame Module Signature Source 0 XUL nsDOMDataTransfer::ClearAll obj-firefox/x86_64/dist/include/nsTArray.h:277 1 XUL nsCopySupport::FireClipboardEvent content/base/src/nsCopySupport.cpp:735 2 XUL nsTextInputSelectionImpl::QueryInterface content/html/content/src/nsTextEditorState.cpp:224 3 XUL nsTextInputSelectionImpl::Release obj-firefox/x86_64/dist/include/nsISupportsImpl.h:193 4 XUL nsEditor::GetSelectionController obj-firefox/x86_64/dist/include/nsCOMPtr.h:410 5 XUL nsEditor::GetSelectionController obj-firefox/x86_64/dist/include/nsIDocument.h:573 6 XUL nsPlaintextEditor::FireClipboardEvent editor/libeditor/text/nsPlaintextEditor.cpp:1150 7 XUL nsPlaintextEditor::Paste editor/libeditor/text/nsPlaintextDataTransfer.cpp:325 8 XUL XPCWrappedNative::FindTearOff js/xpconnect/src/XPCWrappedNative.cpp:1983 9 XUL NS_InvokeByIndex_P xptcinvoke_x86_64_unix.cpp:162 10 libnspr4.dylib PR_GetCurrentThread nsprpub/pr/src/pthreads/ptthread.c:621 11 XUL nsThreadManager::GetIsMainThread nsThreadManager.cpp:272 12 XUL NS_IsMainThread_P nsThreadUtils.cpp:137 13 XUL XPCWrappedNative::CallMethod js/xpconnect/src/XPCWrappedNative.cpp:3085 14 XUL js::DefineNativeProperty js/src/jsobj.cpp:3337 The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=eccf45749400&tochange=7433bc4545c9 It's likely a regression from bug 407983. More reports at: https://crash-stats.mozilla.com/report/list?signature=nsDOMDataTransfer%3A%3AClearAll%28%29 https://crash-stats.mozilla.com/report/list?signature=nsTArray_Impl%3CnsTArray%3CTransferItem%3E%2C+nsTArrayInfallibleAllocator%3E%3A%3AClear%28%29
Blocks: 407983
Status: UNCONFIRMED → NEW
Crash Signature: [@ nsDOMDataTransfer::ClearAll() ] [@ nsTArray_Impl<nsTArray<TransferItem>, nsTArrayInfallibleAllocator>::Clear() ]
status-firefox21: --- → unaffected
status-firefox22: --- → affected
tracking-firefox22: --- → ?
Component: General → DOM: Core & HTML
Ever confirmed: true
Keywords: crash, regression
OS: Mac OS X → All
Hardware: x86 → All
Summary: CRASH [@ nsDOMDataTransfer::ClearAll()] → crash in nsCopySupport::FireClipboardEvent when pasting
Version: Trunk → 22 Branch
Attached patch Fix crash — — Splinter Review
Assignee: nobody → enndeakin
Status: NEW → ASSIGNED
Attachment #724011 - Flags: review?(bugs)
Attachment #724011 - Flags: review?(bugs) → review+
Keywords: topcrash
Crash Signature: [@ nsDOMDataTransfer::ClearAll() ] [@ nsTArray_Impl<nsTArray<TransferItem>, nsTArrayInfallibleAllocator>::Clear() ] → [@ nsDOMDataTransfer::ClearAll() ] [@ nsTArray_Impl<nsTArray<TransferItem>, nsTArrayInfallibleAllocator>::Clear() ] [@ nsCOMArray_base::Count() ]
Crash Signature: [@ nsDOMDataTransfer::ClearAll() ] [@ nsTArray_Impl<nsTArray<TransferItem>, nsTArrayInfallibleAllocator>::Clear() ] [@ nsCOMArray_base::Count() ] → [@ nsDOMDataTransfer::ClearAll() ] [@ nsTArray_Impl<nsTArray<TransferItem>, nsTArrayInfallibleAllocator>::Clear() ] [@ nsCOMArray_base::Count() ] [@ nsTArray_base<nsTArrayInfallibleAllocator>::Length() | nsTArray_Impl<nsTArray<TransferItem>, nsTArrayIn…
What's preventing this patch from landing?
No idea, but it's preventing me from using Nightly. Over to RyanVM to land.
Keywords: checkin-needed, dogfood
It's ok in this case. The tree was closed whenever I wanted to land it. https://hg.mozilla.org/integration/mozilla-inbound/rev/690a86b55ba5
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/690a86b55ba5
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
status-firefox22: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla22
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: