Last Comment Bug 868906 - "ASSERTION: We're referring different frame" with caret browsing, bidi
: "ASSERTION: We're referring different frame" with caret browsing, bidi
: assertion, testcase
Product: Core
Classification: Components
Component: Layout (show other bugs)
: Trunk
: All All
-- minor (vote)
: mozilla23
Assigned To: Mats Palmgren (:mats)
: Sean Voisen (:svoisen)
Depends on:
Blocks: textfuzzer fuzz-keys
  Show dependency treegraph
Reported: 2013-05-05 21:44 PDT by Jesse Ruderman
Modified: 2013-07-15 16:29 PDT (History)
3 users (show)
mats: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

manual testcase (see comment 0) (1014 bytes, text/html)
2013-05-05 21:44 PDT, Jesse Ruderman
no flags Details
stack (gdb) (9.63 KB, text/plain)
2013-05-05 21:47 PDT, Jesse Ruderman
no flags Details
fix+crashtest (4.34 KB, patch)
2013-05-06 15:47 PDT, Mats Palmgren (:mats)
roc: review+
Details | Diff | Splinter Review

Description User image Jesse Ruderman 2013-05-05 21:44:46 PDT
Created attachment 745751 [details]
manual testcase (see comment 0)

1. Load the testcase.
2. Press F6 twice. The content area should now visibly have focus.
3. Press F7 to enable "caret browsing mode".
4. Press Shift, instructing the testcase to call deleteContents().


###!!! ASSERTION: We're referring different frame: 'frame == aForFrame', file layout/base/nsCaret.cpp, line 518

Masayuki added this assertion long ago in
Comment 1 User image Jesse Ruderman 2013-05-05 21:47:37 PDT
Created attachment 745752 [details]
stack (gdb)
Comment 2 User image Mats Palmgren (:mats) 2013-05-06 15:47:22 PDT
Created attachment 746113 [details] [diff] [review]

The problem is that nsTextFrame::GetChildFrameContainingOffset
is unstable such that calling it twice with the same arguments
can give different results in some cases.

The first call stores the resulting frame in OffsetToFrameProperty()
and the next call will start at that frame.  The loop will step to the
next frame if it has the same offset, i.e. the cached frame was empty,
so if there's a sequence of empty continuations we'll get a new result
frame until we reach the last empty frame.
Comment 3 User image Robert O'Callahan (:roc) (email my personal email if necessary) 2013-05-06 17:11:57 PDT
Comment on attachment 746113 [details] [diff] [review]

Review of attachment 746113 [details] [diff] [review]:

Comment 5 User image Ryan VanderMeulen [:RyanVM] 2013-05-07 19:32:09 PDT

Note You need to log in before you can comment on or make changes to this bug.