corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1826272 - Make the content process crash if TextControlState becomes odd state r=m_kato

Browse Source 
If `TextControlState:mTextListener` is set to `nullptr`, at least one of
`TextControlState::mBoundFrame` or `TextControlFrame::mTextEditor` must be
set to `nullptr`.  Therefore, when `TextControlState` realizes the odd state,
it should crash immediately.  Then, we can investigate how to reproduce the
situation from crash reports.

Differential Revision: https://phabricator.services.mozilla.com/D174944
This commit is contained in:
Masayuki Nakano
2023-04-10 23:59:09 +00:00
parent 5d55a4b794
commit f916198a3e
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
dom/html/TextControlState.cpp
View File

@@ -1118,6 +1118,9 @@ class MOZ_STACK_CLASS AutoTextControlHandlingState {
mTextControlAction(aTextControlAction) {
MOZ_ASSERT(aTextControlAction != TextControlAction::SetValue,
"Use specific constructor");
MOZ_DIAGNOSTIC_ASSERT_IF(
!aTextControlState.mTextListener,
!aTextControlState.mBoundFrame || !aTextControlState.mTextEditor);
mTextControlState.mHandlingState = this;
if (Is(TextControlAction::CommitComposition)) {
MOZ_ASSERT(mParent);
@@ -1148,6 +1151,9 @@ class MOZ_STACK_CLASS AutoTextControlHandlingState {
mTextControlAction(aTextControlAction) {
MOZ_ASSERT(aTextControlAction == TextControlAction::SetValue,
"Use generic constructor");
MOZ_DIAGNOSTIC_ASSERT_IF(
!aTextControlState.mTextListener,
!aTextControlState.mBoundFrame || !aTextControlState.mTextEditor);
mTextControlState.mHandlingState = this;
if (!nsContentUtils::PlatformToDOMLineBreaks(mSettingValue, fallible)) {
aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
@@ -1497,6 +1503,7 @@ void TextControlState::Clear() {
// If we have a bound frame around, UnbindFromFrame will call DestroyEditor
// for us.
DestroyEditor();
MOZ_DIAGNOSTIC_ASSERT(!mBoundFrame || !mTextEditor);
}
mTextListener = nullptr;
}