Closed
Bug 1298704
Opened 8 years ago
Closed 8 years ago
Crash in nsBlockFrame::GetMinISize - stack overflow caused by AccessibleCaretEventHub::Reflow callback
Categories
(Core :: DOM: Selection, defect)
Tracking
()
RESOLVED
FIXED
mozilla51
Tracking | Status | |
---|---|---|
firefox51 | --- | fixed |
People
(Reporter: MatsPalmgren_bugz, Assigned: TYLin)
References
(Blocks 1 open bug)
Details
(Keywords: crash)
Crash Data
Attachments
(1 file)
This bug was filed from the Socorro interface and is
report bp-7d0aed6a-35aa-41b9-bc61-9b3892160826.
=============================================================
It looks like AccessibleCaret causes infinite recursion through flushing layout.
Flags: needinfo?(tlin)
Assignee | ||
Updated•8 years ago
|
Comment hidden (mozreview-request) |
Reporter | ||
Comment 2•8 years ago
|
||
mozreview-review |
Comment on attachment 8785831 [details]
Bug 1298704 - Use flag to avoid calling AccessibleCaretEventHub::Reflow() recursively.
https://reviewboard.mozilla.org/r/74902/#review72792
::: layout/base/AccessibleCaretEventHub.h:135
(Diff revision 1)
> bool mInitialized = false;
>
> + // Flag to avoid calling Reflow() callback recursively.
> + bool mIsInReflowCallback = false;
Nit: perhaps we should move both these bool members to after 'mActiveTouchId' instead? (to avoid spilling due to alignment).
::: layout/base/AccessibleCaretEventHub.cpp:686
(Diff revision 1)
>
> NS_IMETHODIMP
> AccessibleCaretEventHub::ReflowInterruptible(DOMHighResTimeStamp aStart,
> DOMHighResTimeStamp aEnd)
> {
> - if (!mInitialized) {
> + // Defer the error checking in Reflow().
s/in/to/
Reporter | ||
Comment 3•8 years ago
|
||
mozreview-review |
Comment on attachment 8785831 [details]
Bug 1298704 - Use flag to avoid calling AccessibleCaretEventHub::Reflow() recursively.
https://reviewboard.mozilla.org/r/74902/#review72796
Attachment #8785831 -
Flags: review?(mats) → review+
Assignee | ||
Comment 4•8 years ago
|
||
mozreview-review-reply |
Comment on attachment 8785831 [details]
Bug 1298704 - Use flag to avoid calling AccessibleCaretEventHub::Reflow() recursively.
https://reviewboard.mozilla.org/r/74902/#review72792
> Nit: perhaps we should move both these bool members to after 'mActiveTouchId' instead? (to avoid spilling due to alignment).
Before applying my patch, `sizeof(AccessibleCaretEventHub)` is 128 on my machine. Though adding the flag to after `mInitialized` does not increase its size, but moving both bool members to after `mActiveTouchId` reduces the size from 128 to 120. Yeh!
Comment hidden (mozreview-request) |
Pushed by tlin@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/e11d9697af59
Use flag to avoid calling AccessibleCaretEventHub::Reflow() recursively. r=mats
Comment 7•8 years ago
|
||
bugherder |
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
You need to log in
before you can comment on or make changes to this bug.
Description
•