372094 - Crash [@ nsThebesRenderingContext::SetFont] [@ nsThebesRenderingContext::GetNativeGraphicData] (trying to scroll option text into view?)

Status: VERIFIED WORKSFORME

(Core :: Graphics, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Regressed between 2006-11-21 and 2006-11-22 nightlies, so I'm guessing it's a regression from turning on Cairo on Mac (bug 323934).

Thread 0 Crashed:
0   libgkgfxthebes.dylib     	0x2fe0f9c9 nsThebesRenderingContext::SetFont(nsFont const&, nsIAtom*) + 87 (nsThebesRenderingContext.cpp:1149)
1   libgklayout.dylib        	0x18420a9b SetFontFromStyle(nsIRenderingContext*, nsStyleContext*) + 75 (nsFrame.cpp:440)
2   libgklayout.dylib        	0x18484333 nsTextStyle::nsTextStyle[in-charge](nsPresContext*, nsIRenderingContext&, nsStyleContext*) + 155 (nsTextFrame.cpp:901)
3   libgklayout.dylib        	0x18488175 nsTextFrame::GetPointFromOffset(nsPresContext*, nsIRenderingContext*, int, nsPoint*) + 253 (nsTextFrame.cpp:4382)
4   libgklayout.dylib        	0x18474885 nsTypedSelection::GetPointFromOffset(nsIFrame*, int, nsPoint*) + 489 (nsSelection.cpp:6956)
5   libgklayout.dylib        	0x18474944 nsTypedSelection::GetCachedFrameOffset(nsIFrame*, int, nsPoint&) + 160 (nsSelection.cpp:5275)
6   libgklayout.dylib        	0x1846aca3 nsTypedSelection::GetSelectionRegionRectAndScrollableView(short, nsRect*, nsIScrollableView**) + 887 (nsSelection.cpp:7033)
7   libgklayout.dylib        	0x1846fb55 nsTypedSelection::ScrollIntoView(short, int) + 417 (nsSelection.cpp:7311)
8   libgklayout.dylib        	0x18465c01 nsFrameSelection::ScrollSelectionIntoView(short, short, int) + 123 (nsSelection.cpp:2534)
9   libgklayout.dylib        	0x183db4e5 PresShell::ScrollSelectionIntoView(short, short, int) + 77 (nsPresShell.cpp:2286)
10  libgklayout.dylib        	0x1880fb80 nsEditor::ScrollSelectionIntoView(int) + 280 (nsEditor.cpp:2492)
11  libgklayout.dylib        	0x18811222 nsEditor::EndPlaceHolderTransaction() + 336 (nsEditor.cpp:987)
12  libgklayout.dylib        	0x18b335b5 nsAutoPlaceHolderBatch::~nsAutoPlaceHolderBatch [not-in-charge]() + 53 (nsEditorUtils.h:66)
13  libgklayout.dylib        	0x18b335d5 nsAutoEditBatch::~nsAutoEditBatch [in-charge]() + 17 (nsEditorUtils.h:78)
14  libgklayout.dylib        	0x1895e235 nsHTMLEditor::Indent(nsAString_internal const&) + 1987 (nsHTMLEditor.cpp:2846)
15  libcomposer.dylib        	0x3a40afd0 nsIndentCommand::DoCommand(char const*, nsISupports*) + 136 (nsComposerCommands.cpp:532)
16  libembedcomponents.dylib 	0x173a2c66 nsControllerCommandTable::DoCommand(char const*, nsISupports*) + 212 (nsControllerCommandTable.cpp:191)
17  libembedcomponents.dylib 	0x1739e17b nsBaseCommandController::DoCommand(char const*) + 317 (nsBaseCommandController.cpp:169)
18  libembedcomponents.dylib 	0x173a0eed nsCommandManager::DoCommand(char const*, nsICommandParams*, nsIDOMWindow*) + 279 (nsCommandManager.cpp:257)
19  libgklayout.dylib        	0x186c9232 nsHTMLDocument::ExecCommand(nsAString_internal const&, int, nsAString_internal const&, int*) + 756 (nsHTMLDocument.cpp:4042)
20  libxpcom_core.dylib      	0x0135af70 NS_InvokeByIndex + 98 (xptcinvoke_unixish_x86.cpp:179)
...

Comment 1

[John Daggett (:jtd)]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.9a6pre) Gecko/20070625 Minefield/3.0a6pre

not reproducible in latest trunk build

Comment 2

[Jesse Ruderman]

Verified WFM (Mac trunk).  No crash, no assertions.

Comment 3

[Jesse Ruderman]

Crashtest checked in.