Crash [@ CheckForTrailingTextFrameRecursive] with focusing and position: absolute with caret browsing enabled

RESOLVED FIXED

Status

()

defect
--
critical
RESOLVED FIXED
12 years ago
6 years ago

People

(Reporter: martijn.martijn, Assigned: roc)

Tracking

({crash, regression, testcase})

Trunk
x86
Windows XP
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments, 1 obsolete attachment)

Reporter

Description

12 years ago
Posted file testcase
See testcase, which crashes when you have caret browsing enabled in current trunk build.

I haven't looked for a regression range (have to go now). Might be useful if someone could find out. Probably a recent regression.

http://crash-stats.mozilla.com/report/index/f601dce6-8e26-11dc-8e65-001a4bd46e84
0  	CheckForTrailingTextFrameRecursive  	 mozilla/layout/base/nsCaret.cpp:623
1 	AdjustCaretFrameForLineEnd 	mozilla/layout/base/nsCaret.cpp:647
2 	nsCaret::GetCaretFrameForNodeOffset(nsIContent*, int, nsFrameSelection::HINT, unsigned char, nsIFrame**, int*) 	mozilla/layout/base/nsCaret.cpp:690
3 	nsCaret::DrawAtPositionWithHint(nsIDOMNode*, int, nsFrameSelection::HINT, unsigned char, int) 	mozilla/layout/base/nsCaret.cpp:570
4 	nsCaret::DrawCaret(int) 	mozilla/layout/base/nsCaret.cpp:1020
5 	nsCaret::CaretBlinkCallback(nsITimer*, void*) 	mozilla/layout/base/nsCaret.cpp:1185
6 	nsTimerImpl::Fire() 	mozilla/xpcom/threads/nsTimerImpl.cpp:400
7 	nsTimerEvent::Run() 	mozilla/xpcom/threads/nsTimerImpl.cpp:487
8 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:490
9 	NS_ProcessNextEvent_P(nsIThread*, int) 	nsThreadUtils.cpp:227
10 	nsBaseAppShell::Run() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
11 	nsAppStartup::Run() 	mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170
12 	XRE_main 	mozilla/toolkit/xre/nsAppRunner.cpp:3142
13 	main 	mozilla/browser/app/nsBrowserApp.cpp:153
14 	WinMain 	mozilla/browser/app/nsBrowserApp.cpp:166
15 	__tmainCRTStartup 	crtexe.c:589
16 	BaseProcessStart
Works: 20071107_1904_firefox-3.0b2pre.en-US.win32
Crash: 20071107_2009_firefox-3.0b2pre.en-US.win32

Checkins to module PhoenixTinderbox between 2007-11-07 19:04 and 2007-11-07 20:08 : 
http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=1194491040&maxdate=1194494939
Reporter

Comment 2

12 years ago
Ok, thanks, I guess it's a regression from bug 336408.
Blocks: 336408
Probably the same as bug 403060.
Assignee: nobody → roc
Blocks: 403060
Posted patch fix (obsolete) — Splinter Review
Here's the fix for this nasty regression.

The main issue is to gracefully handle cases where the line is not found. A secondary issue is that we shouldn't search for any old block ancestor, we should only search up through eLineParticipants. We don't want to look up through a table, for example.
Attachment #287900 - Flags: superreview?(mrbkap)
Attachment #287900 - Flags: review?(mrbkap)
Whiteboard: [needs review]
Comment on attachment 287900 [details] [diff] [review]
fix

Same nit about { on its own line applies here too.
Attachment #287900 - Flags: superreview?(mrbkap)
Attachment #287900 - Flags: superreview+
Attachment #287900 - Flags: review?(mrbkap)
Attachment #287900 - Flags: review+
Posted patch better patchSplinter Review
Slight improvement on the last patch --- don't convert the result for FindLineFor to nsLineBox* right away, since if we're at end_lines() (i.e., not found) that causes an assertion.
Attachment #287900 - Attachment is obsolete: true
Checked in
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED

Updated

12 years ago
Flags: in-testsuite?
Whiteboard: [needs review]
Crash Signature: [@ CheckForTrailingTextFrameRecursive]
You need to log in before you can comment on or make changes to this bug.