Closed Bug 1051556 Opened 5 years ago Closed 4 years ago

crash in java.lang.IllegalArgumentException: invalid selection notification range at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)

Categories

(Firefox for Android :: Keyboards and IME, defect, critical)

All
Android
defect
Not set
critical

Tracking

()

VERIFIED FIXED
Firefox 45
Tracking Status
firefox34 --- wontfix
firefox35 --- wontfix
firefox36 - wontfix
firefox37 --- wontfix
firefox38 --- wontfix
firefox39 --- wontfix
firefox42 --- wontfix
firefox43 + wontfix
firefox44 + verified
firefox45 + verified
firefox46 --- verified
firefox-esr38 --- wontfix
b2g-v2.5 --- fixed
fennec + ---

People

(Reporter: aaronmt, Assigned: jchen)

References

Details

(Keywords: crash)

Crash Data

Attachments

(6 files, 3 obsolete files)

4.71 KB, patch
esawin
: review+
Details | Diff | Splinter Review
9.17 KB, patch
esawin
: review+
Details | Diff | Splinter Review
3.26 KB, patch
esawin
: review+
Details | Diff | Splinter Review
6.92 KB, patch
esawin
: review+
Details | Diff | Splinter Review
8.49 KB, patch
esawin
: review+
Details | Diff | Splinter Review
1.41 KB, patch
esawin
: review+
Details | Diff | Splinter Review
This bug was filed from the Socorro interface and is 
report bp-66c714af-d11f-433a-835e-fe5fb2140808.
=============================================================

java.lang.IllegalArgumentException: invalid selection notification range: 116466 to 116466, length: 71
	at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java:815)
	at org.mozilla.gecko.GeckoAppShell.notifyIMEChange(GeckoAppShell.java:474)
	at org.mozilla.gecko.mozglue.GeckoLoader.nativeRun(Native Method)
	at org.mozilla.gecko.mozglue.GeckoLoader.nativeRun(Native Method)
	at org.mozilla.gecko.GeckoAppShell.runGecko(GeckoAppShell.java:353)
	at org.mozilla.gecko.GeckoThread.run(GeckoThread.java:178)
Duplicate of this bug: 1051621
Oddly only two reports from this crash signature are using 34.0 (20140807) builds.

The common URL's are Etherpad again.
Summary: crash in java.lang.IllegalArgumentException: invalid selection notification range: 116466 to 116466, length: 71 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java) → crash in java.lang.IllegalArgumentException: invalid selection notification range: <n> to <n>, length: <m> at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)
(In reply to Aaron Train [:aaronmt] from comment #2)
> Oddly only two reports from this crash signature are using 34.0 (20140807)
> builds.

Actually, there are many reports with different numbers: https://crash-stats.mozilla.com/search/?signature=~invalid+selection+notification&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform
Still seeing signatures on 35
Crash Signature: [@ java.lang.IllegalArgumentException: invalid selection notification range: 116466 to 116466, length: 71 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] → [@ java.lang.IllegalArgumentException: invalid selection notification range: 116466 to 116466, length: 71 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification rang…
Still seeing these reports on 36
Duplicate of this bug: 1101889
tracking-fennec: --- → ?
Crash Signature: [@ java.lang.IllegalArgumentException: invalid selection notification range: 116466 to 116466, length: 71 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification rang… → [@ java.lang.IllegalArgumentException: invalid selection notification range: 3093 to 3093, length: 0 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range: 27…
Crash Signature: [@ java.lang.IllegalArgumentException: invalid selection notification range: 3093 to 3093, length: 0 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range: 27… → [@ java.lang.IllegalArgumentException: invalid selection notification range: 60917 to 60926, length: 1 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range: …
Assignee: nobody → nchen
tracking-fennec: ? → +
Duplicate of this bug: 1119856
Duplicate of this bug: 1119856
Duplicate of this bug: 1125533
Duplicate of this bug: 1125706
I'm sick of these duplicate reports. This is probably a simple fix, can we get this looked at?
tracking-fennec: + → ?
Crash Signature: , length: 0 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] → , length: 0 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range: 244807 to 244816, length: 236 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEdi…
Assignee: nchen → snorp
tracking-fennec: ? → 38+
Assignee: snorp → esawin
Crash Signature: [@ java.lang.IllegalArgumentException: invalid selection notification range: 60917 to 60926, length: 1 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range: … → [@ java.lang.IllegalArgumentException: invalid selection notification range: 4848 to 4848, length: 0 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range: 60…
Crash Signature: [@ java.lang.IllegalArgumentException: invalid selection notification range: 4848 to 4848, length: 0 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range: 60… → [@ java.lang.IllegalArgumentException: invalid selection notification range: 55389 to 55393, length: 0 at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range: …
Let's unify the crash signatures first to get a better overview on affected URLs and devices by moving the crash details to the log.
Attachment #8572627 - Flags: review?(snorp)
(In reply to Eugen Sawin [:esawin] from comment #13)
> Created attachment 8572627 [details] [diff] [review]
> 0001-Bug-1051556-Simplify-invalid-selection-exception-mes.patch
> 
> Let's unify the crash signatures first to get a better overview on affected
> URLs and devices by moving the crash details to the log.

This might be unnecessary, kbrosnan or kairo might know a soccoro trick
Flags: needinfo?(kbrosnan)
Flags: needinfo?(kairo)
Attachment #8572627 - Flags: review?(snorp) → review+
Just extending the previous patch to all exceptions with dynamic values with high ranges, let's keep reports sane.
Attachment #8572627 - Attachment is obsolete: true
Attachment #8572785 - Flags: review?(snorp)
Fixed syntax error.
Attachment #8572785 - Attachment is obsolete: true
Attachment #8572785 - Flags: review?(snorp)
Attachment #8572794 - Flags: review?(snorp)
Attachment #8572794 - Flags: review?(snorp) → review+
Discussed on IRC.
Status: NEW → ASSIGNED
Flags: needinfo?(kbrosnan)
Flags: needinfo?(kairo)
Looks like I've attached the old version twice, here is the corrected version (just a syntax fix).
Attachment #8572794 - Attachment is obsolete: true
Attachment #8573572 - Flags: review+
Comment on attachment 8573572 [details] [diff] [review]
0001-Bug-1051556-Simplify-GeckoEditable-exception-message.patch

I would like to uplift this to beta for maximum exposure.

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: the crash signature contains highly dynamic values which makes report analysis difficult
[Describe test coverage new/current, TreeHerder]: none required
[Risks and why]: none, this is just a change in the text message of the thrown exception
[String/UUID change made/needed]: none
Attachment #8573572 - Flags: approval-mozilla-beta?
Attachment #8573572 - Flags: approval-mozilla-aurora?
Comment on attachment 8573572 [details] [diff] [review]
0001-Bug-1051556-Simplify-GeckoEditable-exception-message.patch

OK. Let's take this patch that only impacts logging and exception messages to get better information about the crash. Beta+ Aurora+
Attachment #8573572 - Flags: approval-mozilla-beta?
Attachment #8573572 - Flags: approval-mozilla-beta+
Attachment #8573572 - Flags: approval-mozilla-aurora?
Attachment #8573572 - Flags: approval-mozilla-aurora+
(In reply to Aaron Train [:aaronmt] from comment #14)
> (In reply to Eugen Sawin [:esawin] from comment #13)
> > Created attachment 8572627 [details] [diff] [review]
> > 0001-Bug-1051556-Simplify-invalid-selection-exception-mes.patch
> > 
> > Let's unify the crash signatures first to get a better overview on affected
> > URLs and devices by moving the crash details to the log.
> 
> This might be unnecessary, kbrosnan or kairo might know a soccoro trick

You'll need a bug filed against Socorro and a regex to match as well as what to replace it with, like in bug 726385 or bug 865142
[Tracking Requested - why for this release]: signature consolidation, no direct user impact but would help the Android team prioritize this bug. Ride along if there is a 36.0.2
Comment on attachment 8573572 [details] [diff] [review]
0001-Bug-1051556-Simplify-GeckoEditable-exception-message.patch

[Triage Comment]

Taking it for release. Cf comment #25
Attachment #8573572 - Flags: approval-mozilla-release+
Flags: needinfo?(lhenry)
Crash Signature: [@ java.lang.IllegalArgumentException: invalid selection notification range: 55389 to 55393 → [@ java.lang.IllegalArgumentException: invalid selection notification range at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range: 55389 to 55393
Summary: crash in java.lang.IllegalArgumentException: invalid selection notification range: <n> to <n>, length: <m> at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java) → crash in java.lang.IllegalArgumentException: invalid selection notification range at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)
Don't need the old signature examples now that this is on release.
Crash Signature: [@ java.lang.IllegalArgumentException: invalid selection notification range at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range: 55389 to 55393, length: 0 a… → [@ java.lang.IllegalArgumentException: invalid selection notification range at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)]
This ends up around number 15 crash in 36.0.x
Flags: needinfo?(lhenry)
Bug 1148590 handles the crash caused by out-of-editor selection, but there might be other triggers, too.
It looks like we still get crash reports with bug 1148590 fixed, so there must be additional causes for this.
Status: ASSIGNED → NEW
tracking-fennec: 38+ → ?
tracking-fennec: ? → +
Crash Signature: [@ java.lang.IllegalArgumentException: invalid selection notification range at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] → [@ java.lang.IllegalArgumentException: invalid selection notification range at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)] [@ java.lang.IllegalArgumentException: invalid selection notification range at org.mozilla.gecko.GeckoEd…
I can reproduce this crash with this signature:
java.lang.IllegalArgumentException: invalid selection notification range at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java)

Environment: 
Device: Nexus 5 (Android 6.0);
Build: Nightly 45.0a1 (2015-11-16);


Steps to reproduce:
1. Go to http://www-archive.mozilla.org/quality/browser/front-end/testcases/wallet/login.html (short URL: http://goo.gl/vi7z6);
2. Login with random username/passowrd;
3. Tap on the android back button;
4. Tap on the username field and delete one or more characters from the current username;
5. Tap on the saved form history.


Notes:
For further details please check the following video:
https://youtu.be/Q5Pgrv7kFF0
Snorp do you think this is worth a look? Maybe we have a chance to fix this a bit more, now that we can reproduce it. 
This signature is fairly high volume on 43 beta (around 140 crashes per version)
Flags: needinfo?(snorp)
-> jchen?
Assignee: esawin → nchen
Flags: needinfo?(snorp)
I looked at both the crash signatures and 44.0a2 hits and I was unable to get any data on the 2nd signature. For the first one, there have been < 10 crashes in last 28 days, so I do not feel the need to track this for 44. Please re-nominate if there is a crash spike or if you disagree with my assessment.
I think it's fine not to track it; we don't get a lot of Firefox for Android data on the aurora channel, so it's often hard to tell which crashes are important there until that version moves to beta.
A test for this bug requires the Robocop test call some JS functions.
This patch gives testInputConnection the ability to make calls to
content JS. It also converts the existing tests to use JS instead of
using previous workarounds (e.g. using URL hash to set the initial text,
using tab key to change input focus).
Attachment #8695470 - Flags: review?(esawin)
This patch adds a test for this bug by ending an existing composition followed
by setting the value of the input field.
Attachment #8695471 - Flags: review?(esawin)
This patch simplifies the onTextChange method, makes it more efficient
by avoiding unnecessary text copying, and fixes some small bugs.
Attachment #8695472 - Flags: review?(esawin)
We send query text events when flushing IME changes, and sometimes these
events make Gecko commit more pending changes. In that case, we should
try flushing again, so we pick up the new changes.

This patch also makes the process of flushing text changes
transactional, so that if we have to bail due to more pending changes,
nothing will be committed.
Attachment #8695473 - Flags: review?(esawin)
I can reproduce this crash on latest Nightly using Nexus 4 (Android 5.1.1)
1. Go to twitter.com
2. Type "teo" in the username text field
3. From the autocomplete pop-up choose "teovermesan"

=> Nightly crashes
Also got this on nighly today would be great for a fix asap
Getting this on Firefox 44a2, reproducible every time when content is injected into an instance of CKEditor by a specific script. However, I haven't been able to reproduce it on FF42 release for some reason.
Attachment #8695470 - Flags: review?(esawin) → review+
Comment on attachment 8695471 [details] [diff] [review]
Add test for re-flushing changes (v1)

Review of attachment 8695471 [details] [diff] [review]:
-----------------------------------------------------------------

::: mobile/android/tests/browser/robocop/robocop_input.html
@@ +23,5 @@
>            input.focus();
>          },
>  
> +        test_reflush_changes: function() {
> +          let inputEditable = SpecialPowers.wrap(input).QueryInterface(SpecialPowers.Ci.nsIDOMNSEditableElement);

Indentation

@@ +24,5 @@
>          },
>  
> +        test_reflush_changes: function() {
> +          let inputEditable = SpecialPowers.wrap(input).QueryInterface(SpecialPowers.Ci.nsIDOMNSEditableElement);
> +          let inputIme = inputEditable.editor.QueryInterface(SpecialPowers.Ci.nsIEditorIMESupport);

Indentation
Attachment #8695471 - Flags: review?(esawin) → review+
Attachment #8695472 - Flags: review?(esawin) → review+
Comment on attachment 8695473 [details] [diff] [review]
Re-flush IME changes when querying text triggers more changes (v1)

Review of attachment 8695473 [details] [diff] [review]:
-----------------------------------------------------------------

::: mobile/android/base/GeckoEditable.java
@@ +1004,5 @@
>          /* For the "end" parameters, Gecko can pass in a large
>             number to denote "end of the text". Fix that here */
>          final int oldEnd = unboundedOldEnd > mText.length() ? mText.length() : unboundedOldEnd;
>          // new end should always match text
> +        if (unboundedOldEnd < Integer.MAX_VALUE / 2 && unboundedNewEnd != (start + text.length())) {

Can you break that up into two lines for improved readability?

::: widget/android/nsWindow.cpp
@@ +240,5 @@
>          , mIMERanges(new TextRangeArray())
>          , mIMEMaskEventsCount(1) // Mask IME events since there's no focus yet
>          , mIMEUpdatingContext(false)
>          , mIMESelectionChanged(false)
> +        , mIMETextChangedDuringFlush(false)

Can we use an enum for IME state keeping instead to avoid all the boolean parameters?

@@ +321,4 @@
>  
>      void SendIMEDummyKeyEvents();
>      void AddIMETextChange(const IMETextChange& aChange);
> +    void PostFlushIMEChanges(bool aRetry = false);

Passing an enum with, e.g., RETRY, NO_RETRY states, would be more descriptive than a boolean argument.

@@ +2078,5 @@
> +        int32_t start;
> +        int32_t oldEnd;
> +        int32_t newEnd;
> +    };
> +    nsAutoTArray<TextRecord, 4> mTextTransaction;

This is not a member variable (m-prefix).

@@ +2124,3 @@
>      mIMETextChanges.Clear();
>  
> +    for (uint32_t i = 0; i < mTextTransaction.Length(); i++) {

We could use iterators here instead.

@@ +2124,4 @@
>      mIMETextChanges.Clear();
>  
> +    for (uint32_t i = 0; i < mTextTransaction.Length(); i++) {
> +        TextRecord& record = mTextTransaction[i];

Can be const reference.
Attachment #8695473 - Flags: review?(esawin) → review+
Status: NEW → RESOLVED
Closed: 4 years ago
Keywords: leave-open
Resolution: --- → FIXED
Duplicate of this bug: 1231165
[Tracking Requested - why for this release]:
Ritu, in Firefox 43, this is top crash  #5. See: https://crash-stats.mozilla.com/topcrashers/?product=FennecAndroid&version=43.0

Jim, are you planning to request the uplift to aurora and/or beta?
Thanks
Tracked for FF44 as this has occurred ~400 times in last 28 days.
Snorp, this is a top crash on Beta44. Would you be able to help nominate patches for uplift to m-b? Thanks!
Flags: needinfo?(snorp)
The fix actually already made it into Aurora. For Beta, the fix doesn't really apply unless we uplift some other fixes. I think the risk for that is big enough that we should let this ride the trains.
Flags: needinfo?(nchen)
Target Milestone: --- → Firefox 45
Jim, Brad: The first crash signature associated with this top is currently ranked at #11 on 44.0b2 and it has jumped up 8 spots to that rank. This kind of data is not reassuring. Worse yet, on FF43, in the past 7 days, this crash has occurred 6000 times (!!!). I see this becoming a top crasher on FF44 once it's on the release channel. Can we find a way to uplift this to Beta44 unless we are absolutely certain that uplifting would hurt rather than help the current situation? Thanks!
Flags: needinfo?(nchen)
Flags: needinfo?(blassey.bugs)
Jim, can you list the bugs that would also need to be uplifted? Or is there a simpler "paper over" patch we could land on beta?
Flags: needinfo?(blassey.bugs)
This patch ignores the error instead of crashing. It will get rid of this crash and hopefully won't trigger other errors.
Flags: needinfo?(nchen)
Attachment #8703199 - Flags: review?(esawin)
Attachment #8703199 - Flags: review?(esawin) → review+
Comment on attachment 8703199 [details] [diff] [review]
Workaround patch for beta

Approval Request Comment

[Feature/regressing bug #]: N/A

[User impact if declined]: Top-crash for Beta

[Describe test coverage new/current, TreeHerder]: None. This is a simple band-aid patch for Beta only

[Risks and why]: Small; the patch itself is a one-line patch to ignore the error, although it may lead to other errors popping up.

[String/UUID change made/needed]: None
Attachment #8703199 - Flags: approval-mozilla-beta?
Comment on attachment 8703199 [details] [diff] [review]
Workaround patch for beta

band-aid fix for a top crash, taking it.
Attachment #8703199 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Depends on: 1236705
Verified as fixed in Firefox 44  Beta 8;
Device: Nexus 5 (Android 6.0.1).
Status: RESOLVED → VERIFIED
Verified as fixed in builds:
- 45 Beta 9;
- 46.0a2 2016-02-26;
Device: Nexus 5 (Android 6.0.1).
I'm still experiencing this bug in the latest android Aurora build (47.0a2, 2016-04-02). adb logcat is showing this (not sure how to make it formatted as code):

04-02 20:03:01.601 19341 19341 I Keyboard: setKeyboardWidth newWidth=1080, mTotalWidth=1080
04-02 20:03:01.607 19521 20577 D GeckoEditable: reply: Action(3)
04-02 20:03:01.607 19521 20577 D GeckoEditable: reply: Action(3)
04-02 20:03:01.617 19521 20913 D GeckoEditable: offer: Action(6)
04-02 20:03:01.617 19521 20913 D GeckoEditable: icSendComposition(): no composition
04-02 20:03:01.621 19521 20577 D GeckoEditable: onSelectionChange(17319, 17319)
04-02 20:03:01.621 19521 20577 E GeckoEditable: invalid selection notification range: 17319 to 17319, length: 6
04-02 20:03:01.624 19521 20577 E GeckoCrashHandler: >>> REPORTING UNCAUGHT EXCEPTION FROM THREAD 4921 ("Gecko")
04-02 20:03:01.624 19521 20577 E GeckoCrashHandler: java.lang.IllegalArgumentException: invalid selection notification range
04-02 20:03:01.624 19521 20577 E GeckoCrashHandler:     at org.mozilla.gecko.GeckoEditable.onSelectionChange(GeckoEditable.java:981)
04-02 20:03:01.624 19521 20577 E GeckoCrashHandler:     at org.mozilla.gecko.mozglue.GeckoLoader.nativeRun(Native Method)
04-02 20:03:01.624 19521 20577 E GeckoCrashHandler:     at org.mozilla.gecko.GeckoThread.run(GeckoThread.java:443)
04-02 20:03:01.625 19521 20577 E GeckoCrashHandler: Main thread (1) stack:
04-02 20:03:01.625 19521 20577 E GeckoCrashHandler:     android.os.MessageQueue.nativePollOnce(Native Method)
04-02 20:03:01.625 19521 20577 E GeckoCrashHandler:     android.os.MessageQueue.next(MessageQueue.java:323)
04-02 20:03:01.625 19521 20577 E GeckoCrashHandler:     android.os.Looper.loop(Looper.java:135)
04-02 20:03:01.625 19521 20577 E GeckoCrashHandler:     android.app.ActivityThread.main(ActivityThread.java:5417)
04-02 20:03:01.625 19521 20577 E GeckoCrashHandler:     java.lang.reflect.Method.invoke(Native Method)
04-02 20:03:01.625 19521 20577 E GeckoCrashHandler:     com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
04-02 20:03:01.625 19521 20577 E GeckoCrashHandler:     com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)
04-02 20:03:01.658 19521 20577 W google-breakpad: ExceptionHandler::GenerateDump cloned child
04-02 20:03:01.658 19521 20577 W google-breakpad: 20969(�@(�X(��(��H(��H(�
04-02 20:03:01.658 19521 20577 W google-breakpad:
04-02 20:03:01.658 19521 20577 W google-breakpad: ExceptionHandler::SendContinueSignalToChild sent continue signal to child
04-02 20:03:01.659 20969 20577 W google-breakpad: ExceptionHandler::WaitForContinueSignal waiting for continue signal...
04-02 20:03:03.399 20998 20998 D AndroidRuntime: >>>>>> START com.android.internal.os.RuntimeInit uid 10131 <<<<<<


To reproduce, go to https://linustechtips.com/main/contact/ and, in the editor, type @slick (or any username on the site), then tap one of the results that appears in the dropdown. It is converted to a non-content-editable span, then the browser crashes. The tagging feature that this uses is very temperamental though, so if the dropdown isn't appearing, try refreshing the browser or using a different keyboard (Google keyboard works sometimes).
(In reply to Jack W from comment #65)
> I'm still experiencing this bug in the latest android Aurora build (47.0a2,
> 2016-04-02). adb logcat is showing this (not sure how to make it formatted
> as code):

Thanks for the report! I believe this crash is fixed in the latest Nightly build. Can you check that? Although the tagging feature still doesn't work as intended, because you can't enter text after tagging someone.
Flags: needinfo?(jackwickham)
(In reply to Jim Chen [:jchen] [:darchons] from comment #66)
> (In reply to Jack W from comment #65)
> > I'm still experiencing this bug in the latest android Aurora build (47.0a2,
> > 2016-04-02). adb logcat is showing this (not sure how to make it formatted
> > as code):
> 
> Thanks for the report! I believe this crash is fixed in the latest Nightly
> build. Can you check that? Although the tagging feature still doesn't work
> as intended, because you can't enter text after tagging someone.

Yeah, it does seem to be fixed in the latest nightly. I was able to escape from the mention and carry on typing if there was more text on the line, but I'm not sure what's causing that.
Flags: needinfo?(jackwickham)
You need to log in before you can comment on or make changes to this bug.