1772914 - Assertion failure: mIndex >= 0, at /builds/worker/checkouts/gecko/layout/generic/nsLineBox.h:1685

Status: NEW

(Core :: Layout: Block and Inline, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220604-98ee1aee28b0 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --xvfb

Assertion failure: mIndex >= 0, at /builds/worker/checkouts/gecko/layout/generic/nsLineBox.h:1685

#0 0x7fd405691128 in nsLineIterator::GetLineAt(int) src/layout/generic/nsLineBox.h:1685:5
#1 0x7fd4056911c3 in nsLineIterator::FindLineContaining(nsIFrame*, int) src/layout/generic/nsLineBox.cpp:578:27
#2 0x7fd4055caeec in nsIFrame::GetFrameFromDirection(nsDirection, bool, bool, bool, bool) src/layout/generic/nsIFrame.cpp:9353:28
#3 0x7fd4055cab9a in nsFrameSelection::GetPrevNextBidiLevels(nsIContent*, unsigned int, mozilla::CaretAssociationHint, bool) src/layout/generic/nsFrameSelection.cpp:964:13
#4 0x7fd4055caaad in nsFrameSelection::GetPrevNextBidiLevels(nsIContent*, unsigned int, bool) const src/layout/generic/nsFrameSelection.cpp:923:10
#5 0x7fd4054d8357 in nsCaret::GetCaretFrameForNodeOffset(nsFrameSelection*, nsIContent*, int, mozilla::CaretAssociationHint, mozilla::intl::BidiEmbeddingLevel, nsIFrame**, int*) src/layout/base/nsCaret.cpp:726:28
#6 0x7fd4054d8127 in nsCaret::GetFrameAndOffset(mozilla::dom::Selection const*, nsINode*, int, int*, nsIFrame**) src/layout/base/nsCaret.cpp:394:10
#7 0x7fd4054d7aa8 in nsCaret::SchedulePaint(mozilla::dom::Selection*) src/layout/base/nsCaret.cpp:425:21
#8 0x7fd405214964 in mozilla::EditorBase::FinalizeSelection() src/editor/libeditor/EditorBase.cpp:5328:12
#9 0x7fd40528690a in mozilla::HTMLEditor::OnBlur(mozilla::dom::EventTarget const*) src/editor/libeditor/HTMLEditor.cpp:684:17
#10 0x7fd40521fdaf in Blur src/editor/libeditor/EditorEventListener.cpp:1127:48
#11 0x7fd40521fdaf in mozilla::EditorEventListener::HandleEvent(mozilla::dom::Event*) src/editor/libeditor/EditorEventListener.cpp:453:21
#12 0x7fd4052dbe7c in mozilla::HTMLEditorEventListener::HandleEvent(mozilla::dom::Event*) src/editor/libeditor/HTMLEditorEventListener.cpp:102:42
#13 0x7fd4038e352e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1316:22
#14 0x7fd4038e41bd in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1507:17
#15 0x7fd4038d90a4 in HandleEvent src/dom/events/EventListenerManager.h:395:5
#16 0x7fd4038d90a4 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:348:17
#17 0x7fd4038d85f2 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:550:16
#18 0x7fd4038d8c03 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:630:5
#19 0x7fd4038dae91 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1119:11
#20 0x7fd401fce755 in FocusBlurEvent::Run() src/dom/base/nsFocusManager.cpp:2731:12
#21 0x7fd401b39a62 in nsContentUtils::AddScriptRunner(already_AddRefed<nsIRunnable>) src/dom/base/nsContentUtils.cpp:5796:13
#22 0x7fd401b39c9e in nsContentUtils::AddScriptRunner(nsIRunnable*) src/dom/base/nsContentUtils.cpp:5802:3
#23 0x7fd401f90215 in nsFocusManager::FireFocusOrBlurEvent(mozilla::EventMessage, mozilla::PresShell*, nsISupports*, bool, bool, mozilla::dom::EventTarget*) src/dom/base/nsFocusManager.cpp:2871:3
#24 0x7fd401f8f349 in nsFocusManager::SendFocusOrBlurEvent(mozilla::EventMessage, mozilla::PresShell*, mozilla::dom::Document*, nsISupports*, bool, bool, mozilla::dom::EventTarget*) src/dom/base/nsFocusManager.cpp:2845:3
#25 0x7fd401f94a09 in nsFocusManager::BlurImpl(mozilla::dom::BrowsingContext*, mozilla::dom::BrowsingContext*, bool, bool, mozilla::dom::Element*, unsigned long) src/dom/base/nsFocusManager.cpp:2443:7
#26 0x7fd401f86936 in nsFocusManager::Blur(mozilla::dom::BrowsingContext*, mozilla::dom::BrowsingContext*, bool, bool, unsigned long, mozilla::dom::Element*) src/dom/base/nsFocusManager.cpp:2213:12
#27 0x7fd401f8ae8e in nsFocusManager::WindowLowered(mozIDOMWindowProxy*, unsigned long) src/dom/base/nsFocusManager.cpp:845:5
#28 0x7fd406f15eef in nsWebBrowser::FocusDeactivate(unsigned long) src/toolkit/components/browser/nsWebBrowser.cpp:1191:11
#29 0x7fd404950b23 in mozilla::dom::BrowserChild::RecvDeactivate(unsigned long) src/dom/ipc/BrowserChild.cpp:1516:16
#30 0x7fd404a5ef6c in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBrowserChild.cpp:4806:80
#31 0x7fd404ad6323 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8475:32
#32 0x7fd400fa9331 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:1781:25
#33 0x7fd400fa5e85 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >) src/ipc/glue/MessageChannel.cpp:1706:9
#34 0x7fd400fa6a26 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1506:3
#35 0x7fd400fa7db1 in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1604:14
#36 0x7fd4003efcbe in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:475:16
#37 0x7fd4003ca693 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:788:26
#38 0x7fd4003c9243 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:620:15
#39 0x7fd4003c94b3 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:398:36
#40 0x7fd4003f34b9 in operator() src/xpcom/threads/TaskController.cpp:127:37
#41 0x7fd4003f34b9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#42 0x7fd4003def1f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1180:16
#43 0x7fd4003e551d in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:465:10
#44 0x7fd404e7ead8 in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at src/dom/xhr/XMLHttpRequestMainThread.cpp:3073:29)> /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25
#45 0x7fd404e7ead8 in mozilla::dom::XMLHttpRequestMainThread::SendInternal(mozilla::dom::BodyExtractorBase const*, bool, mozilla::ErrorResult&) src/dom/xhr/XMLHttpRequestMainThread.cpp:3072:10
#46 0x7fd404e7d9da in mozilla::dom::XMLHttpRequestMainThread::Send(mozilla::dom::Nullable<mozilla::dom::DocumentOrBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString> const&, mozilla::ErrorResult&) src/dom/xhr/XMLHttpRequestMainThread.cpp
#47 0x7fd402e4019f in mozilla::dom::XMLHttpRequest_Binding::send(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/XMLHttpRequestBinding.cpp:1349:24
#48 0x7fd40337b1ec in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3271:13
#49 0x7fd40882e040 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:420:13
#50 0x7fd40882d84a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:507:12
#51 0x7fd408824c26 in CallFromStack src/js/src/vm/Interpreter.cpp:578:10
#52 0x7fd408824c26 in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3314:16
#53 0x7fd40881bec2 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:389:13
#54 0x7fd40882d746 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:539:13
#55 0x7fd40882ed78 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:605:8
#56 0x7fd4074f95e1 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/vm/CallAndConstruct.cpp:117:10
#57 0x7fd403136440 in mozilla::dom::Function::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/FunctionBinding.cpp:50:8
#58 0x7fd401ef92a2 in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject> >(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:71:12
#59 0x7fd401ef9044 in mozilla::dom::CallbackTimeoutHandler::Call(char const*) src/dom/base/TimeoutHandler.cpp:167:29
#60 0x7fd401bd6f32 in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*) src/dom/base/nsGlobalWindowInner.cpp:6409:38
#61 0x7fd401f0ae8a in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) src/dom/base/TimeoutManager.cpp:903:44
#62 0x7fd401ef6ba0 in mozilla::dom::TimeoutExecutor::MaybeExecute() src/dom/base/TimeoutExecutor.cpp:179:11
#63 0x7fd401ef7149 in Notify src/dom/base/TimeoutExecutor.cpp:246:5
#64 0x7fd401ef7149 in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) src/dom/base/TimeoutExecutor.cpp
#65 0x7fd4004018dc in operator() src/xpcom/threads/nsTimerImpl.cpp:656:44
#66 0x7fd4004018dc in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at src/xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16
#67 0x7fd4004018dc in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at src/xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
#68 0x7fd4004018dc in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at src/xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:902:12
#69 0x7fd4004018dc in match<(lambda at src/xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:857:12
#70 0x7fd4004018dc in nsTimerImpl::Fire(int) src/xpcom/threads/nsTimerImpl.cpp:654:22
#71 0x7fd4003d314e in nsTimerEvent::Run() src/xpcom/threads/TimerThread.cpp:263:11
#72 0x7fd4003f237d in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() src/xpcom/threads/ThrottledEventQueue.cpp:254:22
#73 0x7fd4003eec61 in mozilla::ThrottledEventQueue::Inner::Executor::Run() src/xpcom/threads/ThrottledEventQueue.cpp:81:15
#74 0x7fd4003efcbe in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:475:16
#75 0x7fd4003ca693 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:788:26
#76 0x7fd4003c9243 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:620:15
#77 0x7fd4003c94b3 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:398:36
#78 0x7fd4003f34b9 in operator() src/xpcom/threads/TaskController.cpp:127:37
#79 0x7fd4003f34b9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#80 0x7fd4003def1f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1180:16
#81 0x7fd4003e551d in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:465:10
#82 0x7fd400faed64 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:107:5
#83 0x7fd400ed5f97 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:380:10
#84 0x7fd400ed5ea2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:373:3
#85 0x7fd400ed5ea2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:355:3
#86 0x7fd4051173a8 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#87 0x7fd40727383b in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:875:20
#88 0x7fd400fafcaa in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
#89 0x7fd400ed5f97 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:380:10
#90 0x7fd400ed5ea2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:373:3
#91 0x7fd400ed5ea2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:355:3
#92 0x7fd407272e5c in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:734:34
#93 0x55a4054b2f60 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#94 0x55a4054b2f60 in main src/browser/app/nsBrowserApp.cpp:338:18
#95 0x7fd416f6d082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#96 0x55a405488d0c in _start (/home/worker/builds/m-c-20220604092742-fuzzing-debug/firefox-bin+0x15d0c) (BuildId: 5152346214f88e08b96eb4db46f2e4c7c30b9b5f)

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug 1772914 using build mozilla-central 20220604092742-98ee1aee28b0. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 2

[Daniel Holbert [:dholbert]]

I can reproduce this locally, though for some reason the abort doesn't happen until I do a minimal amount of interaction -- e.g. click the document, or alt-tab away.

(This might be why bugmon was unable to reproduce it?)

Comment 3

[Daniel Holbert [:dholbert]]

Pernosco trace here: https://pernos.co/debug/33EGPM2I4YGW4CJvkv-r8g/index.html

The key moment is here in nsIFrame::GetFrameFromDirection:
https://searchfox.org/mozilla-central/rev/a8bdd0feeb7ae596a202333ee324a68153f9f4c4/layout/generic/nsIFrame.cpp#9351-9352

nsILineIterator* it = blockFrame->GetLineIterator();
int32_t thisLine = it->FindLineContaining(lineFrame);

We hit these lines with the following frame tree, where variable blockFrame == 0x7feef1d73998 ('html' in the frame tree) and lineFrame == 0x7feef1d738d0 ('body' in the frame tree):

            Block(html)(-1)@7feef1d73998 parent=7feef1d72c80 prev-in-flow=7feef1d73730 (x=3066, y=0, w=62, h=1119) ink-overflow=(x=-307, y=0, w=787, h=1119) scr-overflow=(x=-307, y=0, w=787, h=1119) [content=7feeeac03040] [cs=7feef1db0e38:-moz-column-content] <
              OverflowContainersList@7feef1d73a60 <
                Block(body)(1)@7feef1d738d0 parent=7feef1d73998 prev-in-flow=7feef1d73668 (x=480, y=0, w=0, h=0) ink-overflow=(x=-787, y=0, w=787, h=1119) scr-overflow=(x=-787, y=0, w=787, h=1119) [content=7feeeac03160] [cs=7feef1db06b8] <
                  FloatList@7feef1d73988 <
                    Block(dt id=a)(2)@7feef1d73808 parent=7feef1d738d0 prev-in-flow=7feef1d735a0 (x=-787, y=0, w=787, h=1119) wm=h-rtl logical-size=((787 x 1119)) [content=7feeeac03700] [cs=7feef1db0988] <
                    >

Notice that Block(html) has an empty line list here. This is important.

We end up failing the assert because our nsLineIterator 'it' has an mIndex of -1, which in fact is reasonable (not e.g. integer overflow or such nastiness) since that's what it's directly initialized to:

  int32_t mIndex = -1;

https://searchfox.org/mozilla-central/rev/a8bdd0feeb7ae596a202333ee324a68153f9f4c4/layout/generic/nsLineBox.h#1725

Usually, mIndex would then be set to 0 via this code in the constructor:

  nsLineIterator(const nsLineList& aLines, bool aRightToLeft)
      : mLines(aLines), mRightToLeft(aRightToLeft) {
    mIter = mLines.begin();
    if (mIter != mLines.end()) {
      mIndex = 0;
    }

...but in this case, the line-list is empty, so we don't reach that mIndex = 0 assignment.

So: probably GetFrameFromDirection needs to account for the possibility that blockFrame->GetLineIterator(); might already be at the end.