274857 - Pressing Ctrl+Backspace twice in an RTL textarea crashes the browser

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Prognathous]

To reproduce:

1. Open http://oren.gomen.org/mozilla/blank_textareas.html
2. Place the caret in the RTL textarea (upper one)
3. Press Ctrl+Backspace twice

Result: Mozilla crashes.

UA: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041215

This bug doesn't occur with v1.7.x nor with FF 1.x. I'll try to find the exact
build where it regressed a bit later today.

Crash dump coming.

Prog.

Comment 1

[Prognathous]

Attachment: Crash details

Comment 2

[Simon Montagu :smontagu]

Backing out bug 256252 prevents the crash.

Comment 3

[Asaf Romano (gone)]

CCing roc and ginn per comment 2.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This is Ginn's...

Comment 5

[Ginn Chen]

It seems there's a dead circle in nsTextFrame::PeekOffset when pressing
ctrl+left/right arrow or ctrl+backspace.

I'll look into it.

Comment 6

[Ginn Chen]

Attachment: patch

back out one line for RTL,
now ctrl+left/right/backspace does same behaviour with Mozilla 1.4.

For LTR, we should not set mAmount to eSelectNoAmount, otherwise it will break
linux/unix testcase 1 and windows testcase 2 in bug 256252.

Comment 7

[Ginn Chen]

Checking in nsFrame.cpp;
/cvsroot/mozilla/layout/generic/nsFrame.cpp,v  <--  nsFrame.cpp
new revision: 3.532; previous revision: 3.531
done

I think we may remove these lines, after solving Bug 207186.

Comment 8

[(no longer active)]

Mass-assigning the new rtl keyword to RTL-related (see bug 349193).