344164 - Hang when moving right in caret browsing with this testcase

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which hangs current Mozilla trunk build when following these steps:
- Turn caret browsing on (press F7)
- Press the right arrow key a few times

Result:
Hang with 100%cpu, while memory usage seems to increase endlessly.

This regressed between 2006-03-22 and 2006-03-23:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-03-22+07&maxdate=2006-03-23+07&cvsroot=%2Fcvsroot
Perhaps because of bug 330815 or bug 330460?

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: automated testcase

Automated testcase, that hangs directly, but you need to download this locally, because of enhanced privileges.

Comment 3

[Uri Bernstein]

This would be fixed by my patch for bug 309432.

What happens here is that the line inside the inner button is LTR-only (not reordered), and therefore when trying to navigate out of it, the regular (non-bidi) leaf iterator is used. That iterator sends us one frame forward - which in this case means visually backward. Since we're now outside the inner button and in a bidi line, the visual iterator is used to send us visually forward, i.e., logically backward, i.e. to the frame inside the inner button. Since neither of the frames involved in this loop is selectable, we loop forever.

The patch on bug 309432 ensures that the visual iterator is always used in bidi documents, thus preventing the possibility of such cases.

Comment 4

[Uri Bernstein]

Fixed by the checkin on bug 309432.

Comment 5

[Martijn Wargers (dead)]

Verified fixed, using an hourly build:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060713 Minefield/3.0a1