Closed Bug 850198 Opened 11 years ago Closed 11 years ago

crash in nsCopySupport::FireClipboardEvent when pasting

Categories

(Core :: DOM: Core & HTML, defect)

22 Branch
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla22
Tracking Status
firefox21 --- unaffected
firefox22 + fixed

People

(Reporter: metasieben, Assigned: enndeakin)

References

Details

(4 keywords)

Crash Data

Attachments

(1 file)

i'm getting a crash whenever i paste something into an input-field(location-bar/textarea/input).

https://crash-stats.mozilla.com/report/index/bp-b8039968-6bad-4128-abe4-3601e2130312
I can't reproduce on Windows.

Here are the first frames of the stack trace:
Frame 	Module 	Signature 	Source
0 	XUL 	nsDOMDataTransfer::ClearAll 	obj-firefox/x86_64/dist/include/nsTArray.h:277
1 	XUL 	nsCopySupport::FireClipboardEvent 	content/base/src/nsCopySupport.cpp:735
2 	XUL 	nsTextInputSelectionImpl::QueryInterface 	content/html/content/src/nsTextEditorState.cpp:224
3 	XUL 	nsTextInputSelectionImpl::Release 	obj-firefox/x86_64/dist/include/nsISupportsImpl.h:193
4 	XUL 	nsEditor::GetSelectionController 	obj-firefox/x86_64/dist/include/nsCOMPtr.h:410
5 	XUL 	nsEditor::GetSelectionController 	obj-firefox/x86_64/dist/include/nsIDocument.h:573
6 	XUL 	nsPlaintextEditor::FireClipboardEvent 	editor/libeditor/text/nsPlaintextEditor.cpp:1150
7 	XUL 	nsPlaintextEditor::Paste 	editor/libeditor/text/nsPlaintextDataTransfer.cpp:325
8 	XUL 	XPCWrappedNative::FindTearOff 	js/xpconnect/src/XPCWrappedNative.cpp:1983
9 	XUL 	NS_InvokeByIndex_P 	xptcinvoke_x86_64_unix.cpp:162
10 	libnspr4.dylib 	PR_GetCurrentThread 	nsprpub/pr/src/pthreads/ptthread.c:621
11 	XUL 	nsThreadManager::GetIsMainThread 	nsThreadManager.cpp:272
12 	XUL 	NS_IsMainThread_P 	nsThreadUtils.cpp:137
13 	XUL 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:3085
14 	XUL 	js::DefineNativeProperty 	js/src/jsobj.cpp:3337

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=eccf45749400&tochange=7433bc4545c9
It's likely a regression from bug 407983.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsDOMDataTransfer%3A%3AClearAll%28%29
https://crash-stats.mozilla.com/report/list?signature=nsTArray_Impl%3CnsTArray%3CTransferItem%3E%2C+nsTArrayInfallibleAllocator%3E%3A%3AClear%28%29
Blocks: 407983
Status: UNCONFIRMED → NEW
Crash Signature: [@ nsDOMDataTransfer::ClearAll() ] [@ nsTArray_Impl<nsTArray<TransferItem>, nsTArrayInfallibleAllocator>::Clear() ]
Component: General → DOM: Core & HTML
Ever confirmed: true
Keywords: crash, regression
OS: Mac OS X → All
Hardware: x86 → All
Summary: CRASH [@ nsDOMDataTransfer::ClearAll()] → crash in nsCopySupport::FireClipboardEvent when pasting
Version: Trunk → 22 Branch
Attached patch Fix crashSplinter Review
Assignee: nobody → enndeakin
Status: NEW → ASSIGNED
Attachment #724011 - Flags: review?(bugs)
Attachment #724011 - Flags: review?(bugs) → review+
Keywords: topcrash
Crash Signature: [@ nsDOMDataTransfer::ClearAll() ] [@ nsTArray_Impl<nsTArray<TransferItem>, nsTArrayInfallibleAllocator>::Clear() ] → [@ nsDOMDataTransfer::ClearAll() ] [@ nsTArray_Impl<nsTArray<TransferItem>, nsTArrayInfallibleAllocator>::Clear() ] [@ nsCOMArray_base::Count() ]
Crash Signature: [@ nsDOMDataTransfer::ClearAll() ] [@ nsTArray_Impl<nsTArray<TransferItem>, nsTArrayInfallibleAllocator>::Clear() ] [@ nsCOMArray_base::Count() ] → [@ nsDOMDataTransfer::ClearAll() ] [@ nsTArray_Impl<nsTArray<TransferItem>, nsTArrayInfallibleAllocator>::Clear() ] [@ nsCOMArray_base::Count() ] [@ nsTArray_base<nsTArrayInfallibleAllocator>::Length() | nsTArray_Impl<nsTArray<TransferItem>, nsTArrayIn…
What's preventing this patch from landing?
No idea, but it's preventing me from using Nightly. Over to RyanVM to land.
It's ok in this case. The tree was closed whenever I wanted to land it.

https://hg.mozilla.org/integration/mozilla-inbound/rev/690a86b55ba5
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/690a86b55ba5
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla22
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: