Closed Bug 403048 Opened 14 years ago Closed 14 years ago

Crash [@ CheckForTrailingTextFrameRecursive] with focusing and position: absolute with caret browsing enabled


(Core :: Layout, defect)

Windows XP
Not set





(Reporter: martijn.martijn, Assigned: roc)



(Keywords: crash, regression, testcase)

Crash Data


(2 files, 1 obsolete file)

Attached file testcase
See testcase, which crashes when you have caret browsing enabled in current trunk build.

I haven't looked for a regression range (have to go now). Might be useful if someone could find out. Probably a recent regression.
0  	CheckForTrailingTextFrameRecursive  	 mozilla/layout/base/nsCaret.cpp:623
1 	AdjustCaretFrameForLineEnd 	mozilla/layout/base/nsCaret.cpp:647
2 	nsCaret::GetCaretFrameForNodeOffset(nsIContent*, int, nsFrameSelection::HINT, unsigned char, nsIFrame**, int*) 	mozilla/layout/base/nsCaret.cpp:690
3 	nsCaret::DrawAtPositionWithHint(nsIDOMNode*, int, nsFrameSelection::HINT, unsigned char, int) 	mozilla/layout/base/nsCaret.cpp:570
4 	nsCaret::DrawCaret(int) 	mozilla/layout/base/nsCaret.cpp:1020
5 	nsCaret::CaretBlinkCallback(nsITimer*, void*) 	mozilla/layout/base/nsCaret.cpp:1185
6 	nsTimerImpl::Fire() 	mozilla/xpcom/threads/nsTimerImpl.cpp:400
7 	nsTimerEvent::Run() 	mozilla/xpcom/threads/nsTimerImpl.cpp:487
8 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:490
9 	NS_ProcessNextEvent_P(nsIThread*, int) 	nsThreadUtils.cpp:227
10 	nsBaseAppShell::Run() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
11 	nsAppStartup::Run() 	mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170
12 	XRE_main 	mozilla/toolkit/xre/nsAppRunner.cpp:3142
13 	main 	mozilla/browser/app/nsBrowserApp.cpp:153
14 	WinMain 	mozilla/browser/app/nsBrowserApp.cpp:166
15 	__tmainCRTStartup 	crtexe.c:589
16 	BaseProcessStart
Works: 20071107_1904_firefox-3.0b2pre.en-US.win32
Crash: 20071107_2009_firefox-3.0b2pre.en-US.win32

Checkins to module PhoenixTinderbox between 2007-11-07 19:04 and 2007-11-07 20:08 :
Ok, thanks, I guess it's a regression from bug 336408.
Blocks: 336408
Probably the same as bug 403060.
Assignee: nobody → roc
Blocks: 403060
Attached patch fix (obsolete) — Splinter Review
Here's the fix for this nasty regression.

The main issue is to gracefully handle cases where the line is not found. A secondary issue is that we shouldn't search for any old block ancestor, we should only search up through eLineParticipants. We don't want to look up through a table, for example.
Attachment #287900 - Flags: superreview?(mrbkap)
Attachment #287900 - Flags: review?(mrbkap)
Whiteboard: [needs review]
Comment on attachment 287900 [details] [diff] [review]

Same nit about { on its own line applies here too.
Attachment #287900 - Flags: superreview?(mrbkap)
Attachment #287900 - Flags: superreview+
Attachment #287900 - Flags: review?(mrbkap)
Attachment #287900 - Flags: review+
Attached patch better patchSplinter Review
Slight improvement on the last patch --- don't convert the result for FindLineFor to nsLineBox* right away, since if we're at end_lines() (i.e., not found) that causes an assertion.
Attachment #287900 - Attachment is obsolete: true
Checked in
Closed: 14 years ago
Resolution: --- → FIXED
Flags: in-testsuite?
Whiteboard: [needs review]
Crash Signature: [@ CheckForTrailingTextFrameRecursive]
You need to log in before you can comment on or make changes to this bug.