297224 - Lockup in nsFrame::PeekOffset() with textarea element.

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Johnny Stenback (:jst)]

Hitting the down arrow key when on the last line in the textarea in the testcase
I'm about to attach makes Deer Park (alpha 1) lock up. The lock up is in
nsFrame::PeekOffset(), we're spinning forever in the while loop in the
eSelectLine case.

Comment 1

[Johnny Stenback (:jst)]

This is a regression since 1.0. Still works on the 1.0.1 branch, so something
changed on the trunk...

Comment 2

[Ronald Tilby]

Where's the promised testcase?

Comment 3

[Mats Palmgren (inactive)]

jst, could you attach your testcase please?

Comment 4

[Benjamin Smedberg]

blocking- until a testcase appears ;-) please renominate then.

Comment 5

[Johnny Stenback (:jst)]

Attachment: The long-lost testcase

Duh, totally missed the fact that I forgot to attach the testcase here :(

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: potential solution

Note: The caret has to not be over the "Submit" button when you push down or
you will not see the hang.

What's happening here is that when we set nearStoppingFrame, we set it to the
first frame in the current line unconditionally (even if this frame is not a
leaf). While we're iterating over the frames in the line, we use a leaf
iterator to do so, checking against nearStoppingFrame to see if we've hit the
first frame in the line. In this case, nearStoppingFrame is the button frame,
but it isn't a leaf, so the frame travseral passes it up and goes to its
previous frame, namely, the HR frame. The HR frame is a block, so we look for a
place to put the caret in _it_, but all that does is bring us to the next line,
where we loop.

This patch makes the frame traversal "extensive", so we always hit
nearStoppingFrame. Another possibility would be to always dig into the last
leaf of every frame we encounter. Roc, do you have any preference?

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: alternate approach

This is the alternate solution.

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 187821 [details] [diff] [review]
potential solution

This is a small patch to fix an easy-to-trigger (in the right circumstances)
hang.

Comment 9

[Benjamin Smedberg]

Comment on attachment 187821 [details] [diff] [review]
potential solution

Please land today.

Comment 10

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked in.

Comment 11

[Tuukka Tolvanen (sp3000)]

this seems to have caused a freeze selecting across a select dropdown arrow, bug
299533