Bug 1336011 - Fix Crash in InvalidArrayIndex_CRASH in mozilla::EditorBase::DeleteSelectionImpl

* EditorBase shouldn't refer mActionListeners directly in loops because it might be removed during a loop
* Create an alias of the type of mEditorObservers
* Create an alias of the type of mDocStateListeners

Tag #1375

editor/libeditor/EditorBase.cpp

@@ -1385,10 +1385,13 @@ EditorBase::CreateNode(nsIAtom* aTag,
 
   AutoRules beginRulesSniffing(this, EditAction::createNode, nsIEditor::eNext);
 
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->WillCreateNode(nsDependentAtomString(aTag),
                                GetAsDOMNode(aParent), aPosition);
     }
+  }
 
   nsCOMPtr<Element> ret;
 
@@ -1402,10 +1405,13 @@ EditorBase::CreateNode(nsIAtom* aTag,
 
   mRangeUpdater.SelAdjCreateNode(aParent, aPosition);
 
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->DidCreateNode(nsDependentAtomString(aTag), GetAsDOMNode(ret),
                               GetAsDOMNode(aParent), aPosition, rv);
     }
+  }
 
   return ret.forget();
 }
@@ -1429,10 +1435,13 @@ EditorBase::InsertNode(nsIContent& aNode,
 {
   AutoRules beginRulesSniffing(this, EditAction::insertNode, nsIEditor::eNext);
 
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->WillInsertNode(aNode.AsDOMNode(), aParent.AsDOMNode(),
                                aPosition);
     }
+  }
 
   RefPtr<InsertNodeTransaction> transaction =
     CreateTxnForInsertNode(aNode, aParent, aPosition);
@@ -1440,10 +1449,13 @@ EditorBase::InsertNode(nsIContent& aNode,
 
   mRangeUpdater.SelAdjInsertNode(aParent.AsDOMNode(), aPosition);
 
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->DidInsertNode(aNode.AsDOMNode(), aParent.AsDOMNode(), aPosition,
                               rv);
     }
+  }
 
   return rv;
 }
@@ -1468,9 +1480,12 @@ EditorBase::SplitNode(nsIContent& aNode,
 {
   AutoRules beginRulesSniffing(this, EditAction::splitNode, nsIEditor::eNext);
 
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->WillSplitNode(aNode.AsDOMNode(), aOffset);
     }
+  }
 
   RefPtr<SplitNodeTransaction> transaction =
     CreateTxnForSplitNode(aNode, aOffset);
@@ -1482,10 +1497,13 @@ EditorBase::SplitNode(nsIContent& aNode,
   mRangeUpdater.SelAdjSplitNode(aNode, aOffset, newNode);
 
   nsresult rv = aResult.StealNSResult();
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->DidSplitNode(aNode.AsDOMNode(), aOffset, GetAsDOMNode(newNode),
                              rv);
     }
+  }
   // Note: result might be a success code, so we can't use Throw() to
   // set it on aResult.
   aResult = rv;
@@ -1520,10 +1538,13 @@ EditorBase::JoinNodes(nsINode& aLeftNode,
   // Find the number of children of the lefthand node
   uint32_t oldLeftNodeLen = aLeftNode.Length();
 
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->WillJoinNodes(aLeftNode.AsDOMNode(), aRightNode.AsDOMNode(),
                               parent->AsDOMNode());
     }
+  }
 
   nsresult rv = NS_OK;
   RefPtr<JoinNodeTransaction> transaction =
@@ -1535,10 +1556,13 @@ EditorBase::JoinNodes(nsINode& aLeftNode,
   mRangeUpdater.SelAdjJoinNodes(aLeftNode, aRightNode, *parent, offset,
                                 (int32_t)oldLeftNodeLen);
 
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->DidJoinNodes(aLeftNode.AsDOMNode(), aRightNode.AsDOMNode(),
                              parent->AsDOMNode(), rv);
     }
+  }
 
   return rv;
 }
@@ -1558,9 +1582,12 @@ EditorBase::DeleteNode(nsINode* aNode)
                                nsIEditor::ePrevious);
 
   // save node location for selection updating code.
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->WillDeleteNode(aNode->AsDOMNode());
     }
+  }
 
   RefPtr<DeleteNodeTransaction> transaction;
   nsresult rv = CreateTxnForDeleteNode(aNode, getter_AddRefs(transaction));
@@ -1568,9 +1595,12 @@ EditorBase::DeleteNode(nsINode* aNode)
     rv = DoTransaction(transaction);
   }
 
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->DidDeleteNode(aNode->AsDOMNode(), rv);
     }
+  }
 
   NS_ENSURE_SUCCESS(rv, rv);
   return NS_OK;
@@ -1844,7 +1874,7 @@ void
 EditorBase::NotifyEditorObservers(NotificationForEditorObservers aNotification)
 {
   // Copy the observers since EditAction()s can modify mEditorObservers.
-  nsTArray<mozilla::OwningNonNull<nsIEditorObserver>> observers(mEditorObservers);
+  AutoEditorObserverArray observers(mEditorObservers);
   switch (aNotification) {
     case eNotifyEditorObserversOfEnd:
       mIsInEditAction = false;
@@ -2505,11 +2535,14 @@ EditorBase::InsertTextIntoTextNodeImpl(const nsAString& aStringToInsert,
   }
 
   // Let listeners know what's up
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->WillInsertText(
         static_cast<nsIDOMCharacterData*>(insertedTextNode->AsDOMNode()),
         insertedOffset, aStringToInsert);
     }
+  }
 
   // XXX We may not need these view batches anymore.  This is handled at a
   // higher level now I believe.
@@ -2518,11 +2551,14 @@ EditorBase::InsertTextIntoTextNodeImpl(const nsAString& aStringToInsert,
   EndUpdateViewBatch();
 
   // let listeners know what happened
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->DidInsertText(
         static_cast<nsIDOMCharacterData*>(insertedTextNode->AsDOMNode()),
         insertedOffset, aStringToInsert, rv);
     }
+  }
 
   // Added some cruft here for bug 43366.  Layout was crashing because we left
   // an empty text node lying around in the document.  So I delete empty text
@@ -2583,8 +2619,7 @@ EditorBase::NotifyDocumentListeners(
     return NS_OK;
   }
 
-  nsTArray<OwningNonNull<nsIDocumentStateListener>>
+  AutoDocumentStateListenerArray listeners(mDocStateListeners);
-    listeners(mDocStateListeners);
   nsresult rv = NS_OK;
 
   switch (aNotificationType) {
@@ -2656,20 +2691,26 @@ EditorBase::DeleteText(nsGenericDOMDataNode& aCharData,
                                nsIEditor::ePrevious);
 
   // Let listeners know what's up
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->WillDeleteText(
           static_cast<nsIDOMCharacterData*>(GetAsDOMNode(&aCharData)), aOffset,
           aLength);
     }
+  }
 
   nsresult rv = DoTransaction(transaction);
 
   // Let listeners know what happened
-  for (auto& listener : mActionListeners) {
+  {
+    AutoActionListenerArray listeners(mActionListeners);
+    for (auto& listener : listeners) {
       listener->DidDeleteText(
           static_cast<nsIDOMCharacterData*>(GetAsDOMNode(&aCharData)), aOffset,
           aLength, rv);
     }
+  }
 
   return rv;
 }
@@ -4034,24 +4075,29 @@ EditorBase::DeleteSelectionImpl(EDirection aAction,
   if (NS_SUCCEEDED(rv)) {
     AutoRules beginRulesSniffing(this, EditAction::deleteSelection, aAction);
     // Notify nsIEditActionListener::WillDelete[Selection|Text|Node]
+    {
+      AutoActionListenerArray listeners(mActionListeners);
       if (!deleteNode) {
-      for (auto& listener : mActionListeners) {
+        for (auto& listener : listeners) {
           listener->WillDeleteSelection(selection);
         }
       } else if (deleteCharData) {
-      for (auto& listener : mActionListeners) {
+        for (auto& listener : listeners) {
           listener->WillDeleteText(deleteCharData, deleteCharOffset, 1);
         }
       } else {
-      for (auto& listener : mActionListeners) {
+        for (auto& listener : listeners) {
           listener->WillDeleteNode(deleteNode->AsDOMNode());
         }
       }
+    }
 
     // Delete the specified amount
     rv = DoTransaction(transaction);
 
     // Notify nsIEditActionListener::DidDelete[Selection|Text|Node]
+    {
+      AutoActionListenerArray listeners(mActionListeners);
       if (!deleteNode) {
         for (auto& listener : mActionListeners) {
           listener->DidDeleteSelection(selection);
@@ -4066,6 +4112,7 @@ EditorBase::DeleteSelectionImpl(EDirection aAction,
         }
       }
     }
+  }
 
   return rv;
 }

editor/libeditor/EditorBase.h

@@ -987,11 +987,17 @@ protected:
   RefPtr<TextComposition> mComposition;
 
   // Listens to all low level actions on the doc.
-  nsTArray<OwningNonNull<nsIEditActionListener>> mActionListeners;
+  typedef AutoTArray<OwningNonNull<nsIEditActionListener>, 5>
+            AutoActionListenerArray;
+  AutoActionListenerArray mActionListeners;
   // Just notify once per high level change.
-  nsTArray<OwningNonNull<nsIEditorObserver>> mEditorObservers;
+  typedef AutoTArray<OwningNonNull<nsIEditorObserver>, 3>
+            AutoEditorObserverArray;
+  AutoEditorObserverArray mEditorObservers;
   // Listen to overall doc state (dirty or not, just created, etc.).
-  nsTArray<OwningNonNull<nsIDocumentStateListener>> mDocStateListeners;
+  typedef AutoTArray<OwningNonNull<nsIDocumentStateListener>, 1>
+            AutoDocumentStateListenerArray;
+  AutoDocumentStateListenerArray mDocStateListeners;
 
   // Cached selection for AutoSelectionRestorer.
   SelectionState mSavedSel;