331958 - Crash when selecting text, using rtl object with css generated content and designMode

Status: VERIFIED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, that crashes current trunk Mozilla builds, when starting the selection outside the block and then moving inside it.

This regressed between 2006-02-21 and 2006-02-22, so I think it's a regression from bug 299065.

Talkback ID: TB16947026X
0x00000000
GetNearestCapturingView   nsFrame::HandleEvent   nsPresShellEventCB::HandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventTargetChainItem::CreateChainAndHandleEvent   nsEventDispatcher::Dispatch   PresShell::HandleEventInternal   PresShell::HandlePositionedEvent   PresShell::HandleEvent   nsViewManager::HandleEvent   nsViewManager::DispatchEvent   HandleEvent   nsWindow::DispatchEvent   nsWindow::DispatchMouseEvent

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: Backtrace

I don't get a backtrace from the crash with a debug build, but prior to the crash I get this assertion (I attached the backtrace for that assertion).
###!!! ASSERTION: continuing frame had more severe impact than first-in-flow: '!
frame->GetPrevContinuation()', file c:/mozilla/mozilla/layout/base/nsFrameManage
r.cpp, line 1374

Comment 3

[Martijn Wargers (dead)]

Well, I just filed 331967, which seems similar to this bug (with steps to reproduce and talkback), but but that bug doesn't use rtl text and has a different regression range. Might be useful to know.

Comment 4

[Uri Bernstein]

Reproducable on OS X => All/All

Comment 5

[Uri Bernstein]

Attachment: patch

Changed one case of GetPrevInFlow which I originally missed to GetPrevContinuation. Also changed variable names and comments to reflect the fact  that we're dealing with continuations, not necessarily in-flows.

Comment 6

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Comment on attachment 216611 [details] [diff] [review]
patch

r+sr=dbaron.  Sorry for the delay.

Comment 7

[Uri Bernstein]

Checked in:
Checking in layout/base/nsFrameManager.cpp;
/cvsroot/mozilla/layout/base/nsFrameManager.cpp,v  <--  nsFrameManager.cpp
new revision: 1.229; previous revision: 1.228
done

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using https://bugzilla.mozilla.org/attachment.cgi?id=216514 as the testcase with build 2006-04-10-16 of SeaMonkey trunk on Windows XP.

No crash.

Comment 9

[(no longer active)]

Mass-assigning the new rtl keyword to RTL-related (see bug 349193).