389437 - crashes [@ nsSampleWordBreaker::NextWord] when using Alt+Arrow in text fields

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[:Gavin Sharp [email: [e-mail]]]

Attachment: stack

I've recently been experiencing crashes when using Alt+Arrow to move the cursor around word-by-word in text boxes. I've noticed this most recently in the Gmail compose window, although I'm pretty sure I've seen it in "normal" textareas/inputs as well. I don't have a consistent set of steps to reproduce the issue, although I think it may be related to moving from one line to the next. All I have is a stack from a Mac opt build, I'll see if I can get one from a debug build with a line number.

Comment 2

[Benjamin Smedberg]

http://crash-stats.mozilla.com/report/list?range_unit=weeks&branch=1.9&range_value=2&signature=nsSampleWordBreaker%3A%3ANextWord(unsigned+short+const+*%2Cunsigned+int%2Cunsigned+int%29

Regression appears to have happened around 7/13

Comment 3

[timeless]

xul!nsSampleWordBreaker::NextWord+0xb [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\intl\lwbrk\src\nssamplewordbreaker.cpp @ 166]
xul!ClusterIterator::ClusterIterator+0x10d [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\generic\nstextframethebes.cpp @ 4762]
xul!nsTextFrame::PeekOffsetWord+0x5a [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\generic\nstextframethebes.cpp @ 4781]
xul!nsIFrame::PeekOffset+0x3e6 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\generic\nsframe.cpp @ 4839]
xul!nsFrameSelection::MoveCaret+0x255 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\generic\nsselection.cpp @ 1350]
xul!nsFrameSelection::WordMove+0x18 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\generic\nsselection.cpp @ 2765]

Comment 4

[Steve England [:stevee]]

Gavin, do the steps in bug 391356 crash for you? (That bug looks like a dup of this one)

Comment 5

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #4)
> Gavin, do the steps in bug 391356 crash for you? (That bug looks like a dup of
> this one)

I can't seem to reproduce using those steps, but that bug does look like a dupe.

Comment 6

[:Gavin Sharp [email: [e-mail]]]

Oh, and I'm testing Mac - could be a platform difference that make your steps only work on Windows, I guess.

Comment 8

[Daniel Holbert [:dholbert] (PTO until 2/24)]

(In reply to comment #6)
> Oh, and I'm testing Mac - could be a platform difference that make your steps
> only work on Windows, I guess.

Not windows-specific -- I get a crash from following those steps under Linux, at least.

Comment 9

[Daniel Holbert [:dholbert] (PTO until 2/24)]

Related Issue: We're don't correctly handle a trailing space character in Gmail's compose box.

Steps to show this:
1. Open up a gmail compose window.
2. Type "a " (no quotes, but with a single trailing space)
3. Press return key
4. Press left-arrow key
  ** Notice that the cursor is immediately after "a", hiding the fact that there's a space there.
5. Press "b"
  ** Notice that the space has reappeared, between "a" and "b"
6. Press backspace to delete the 'a'
  ** Notice that the space is hidden again.
7. Press backspace to delete the invisible space.
  ** Notice that cursor doesn't move as invisible space is deleted.

Conclusion: The space is there, sort of, but we're not showing it.


Side Note 1: 
   Not only are we not showing it, but the arrow keys don't seem to respect the space.  Pressing left-arrow and right-arrow keys will skip right over the invisible space, as if it weren't there. (as opposed to the backspace key, which does actually delete the invisible space without moving the cursor, as shown in the above steps)


Side Note 2:
  - When coming at the invisible space from the left side, via pressing right-arrow, it's impossible to reach a position *immediately after* the invisible space.
  - Similarly, when coming at the invisible space from the following line, via pressing left-arrow, it's impossible to reach the position *immediately before* the invisible space.  (You can demonstrate this by navigating with the arrow keys, and then typing some text to see where you are with respect to the invisible space.)

Comment 10

[Martijn Wargers (dead)]

Attachment: testcase

I get this crash when double-clicking the first word in the sentence of this testcase.
I get indeed a regression range between 2007-07-12 and 2007-07-13.

Comment 11

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

The wordbreaker should be able to handle being passed aPos==aLength.

Simon, who should sr this?

Comment 12

[Simon Montagu :smontagu]

Comment on attachment 279826 [details] [diff] [review]
fix

r+moa=me, and intl policy is that you don't need sr if you have moa :)

Comment 13

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 279826 [details] [diff] [review]
fix

need approval from M8 drivers right now

Comment 14

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in