414018 - crash when pressing shift-tab after using FAYT

Status: VERIFIED FIXED

(Toolkit :: Find Toolbar, defect, P1)

Description

[Ori Avtalion (salty-horse)]

Attachment: test-case with instructions

Using Firefox 3 nightly build.

When invoking FAYT and pressing shift-tab to move the focus backwards in the document, the focus moves to the navigation toolbar.
After invoking FAYT again, Firefox crashes.

The attached test-case has instructions to reproduce the crash.

Stack trace: http://pastebin.mozilla.org/311697

Comment 1

[Ori Avtalion (salty-horse)]

Attachment: stack trace

Attaching the stack trace linked from the pastebin.

Comment 2

[Matthew Cline]

WFM with Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b3pre) Gecko/2008012504 Minefield/3.0b3pre ID:2008012504

Comment 3

[Sylvain Pasche]

Another testcase:

1. Load an empty page, like data:text/html,
2. Press / or ' to trigger FAYT
3. Press shift-tab
4. Press / or ' -> it crashes
5. If you weren't quick enough, the find toolbar may have closed between step 3 and 4. You can now type any key to make it crash.

Regression range:

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-11-27+04%3A00%3A00&maxdate=2007-11-28+17%3A00%3A00&cvsroot=%2Fcvsroot

I'm not sure what is to blame in this range.

This also crashes on Windows:
http://crash-stats.mozilla.com/report/index/fdc21c00-cc3c-11dc-b629-001a4bd46e84

Comment 4

[Mats Palmgren (inactive)]

Backing out bug 143065 seems to fix this (it's in the regression range above).

Comment 5

[Mats Palmgren (inactive)]

Attachment: Revert the change to MoveCaretToFocus() from bug 143065

FWIW, this fixes it for me...

Comment 6

[[e-mail]]

Sorry, that change was actually for bug 399427; I do normally manage to keep my patches separate but I must have overlooked it in that case. Feel free to arrange a backout of that erroneously checked-in patch.

FYI I was eventually able to reproduce the crash with SeaMonkey FAYT; the bug still remains that Find crashes if its ranges point at documents which otherwise would appear to be legal range endpoints.

Comment 7

[Mats Palmgren (inactive)]

Let's back out for now and leave it for bug 399427.
Will you file a separate bug on fixing the document as range point crash?

Comment 8

[[e-mail]]

(In reply to comment #7)
>Will you file a separate bug on fixing the document as range point crash?
Filed bug 414338.

Comment 9

[Reed Loden [:reed]]

Comment on attachment 299500 [details] [diff] [review]
Revert the change to MoveCaretToFocus() from bug 143065

Fixes an easily reproducible crash.

Comment 10

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 299500 [details] [diff] [review]
Revert the change to MoveCaretToFocus() from bug 143065

a=beltzner for beta 3

Comment 11

[Reed Loden [:reed]]

Checking in content/events/src/nsEventStateManager.cpp;
/cvsroot/mozilla/content/events/src/nsEventStateManager.cpp,v  <--  nsEventStateManager.cpp
new revision: 1.728; previous revision: 1.727
done

Comment 12

[Tony Chung [:tchung]]

Verified fix on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3 and 
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b3) Gecko/2008020418 Firefox/3.0b3