162119 - Crash while selecting BiDi text

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Thamer Mahmoud]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.1b) Gecko/20020808
BuildID:    2002080813

Many crashes experienced while selecting Arabic text in over a month of using
mozilla. Some of those crashes are not reproducible, but others are. This is a
simple testcase that shows an *Always* reproducible example.

Reproducible: Always
Steps to Reproduce:
1. Open included testcase
2. Select multiple lines or full text starting with the first line
3. Crash

Actual Results:  Browser crash


Expected Results:  No crash (and then Bug #82352)

Comment 1

[Thamer Mahmoud]

Attachment: Testcase (may crash browser)

Comment 2

[Olivier Cahagne]

confirming crash using build 20020810 on Linux (trunk).

Comment 3

[Olivier Cahagne]

Talkback ID from build 2002080908 on Win2k (trunk): TB9201843G.

Comment 4

[Boris Zbarsky [:bzbarsky]]

nsSelection::VisualSequence
[c:/builds/seamonkey/mozilla/content/base/src/nsSelection.cpp, line 1931]
nsSelection::VisualSelectFrames
[c:/builds/seamonkey/mozilla/content/base/src/nsSelection.cpp, line 2257]
nsSelection::HandleDrag
[c:/builds/seamonkey/mozilla/content/base/src/nsSelection.cpp, line 2698]
nsFrame::HandleDrag
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrame.cpp, line 1501]
nsFrame::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrame.cpp, line 818]
nsBlockFrame::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 6044]
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6124]
PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6030]
nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2098]
nsView::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 301]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1909]
HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 83]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1038]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1055]
nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5127]
ChildWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5382]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3834]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1304]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x30e0 (0x77e130e0)
USER32.DLL + 0x5824 (0x77e15824)
nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 452]
main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1532]
main [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1883]
WinMain [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1901]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 5

[Olivier Cahagne]

Attachment: gdb stack trace (from Linux 20020811)

Comment 6

[Olivier Cahagne]

Didn't find dupes, marking NEW.
Component -> BiDi as it seems to be BiDi specific and a selection crasher has
already been filed in this component previously, bug 136552.

Comment 7

[Simon Montagu :smontagu]

I can no longer reproduce this with the fix for bug 76190 (and the crash is in
code which that patch has removed), so marking FIXED