466982 - Crash [@ nsTextFrame::GetContentEnd] with bindings, ::first-letter, generated content, contenteditable, etc

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: binding2 needed for testcase

See upcoming testcase, which crashes in current trunk build and Firefox 3 (so marking security sensitive for now).
It doesn't crash in Firefox 2, I can look for a regression range, if wanted.

http://crash-stats.mozilla.com/report/index/df38c47a-59bd-4d14-913b-6daa22081127?p=1
0  	xul.dll  	nsTextFrame::GetContentEnd  	 layout/generic/nsTextFrameThebes.cpp:449
1 	xul.dll 	BuildTextRunsScanner::AccumulateRunInfo 	layout/generic/nsTextFrameThebes.cpp:1143
2 	xul.dll 	BuildTextRunsScanner::ScanFrame 	layout/generic/nsTextFrameThebes.cpp:1266
3 	xul.dll 	xul.dll@0x2f4c6a 	
4 	xul.dll 	BuildTextRuns 	layout/generic/nsTextFrameThebes.cpp:1031
5 	xul.dll 	nsTextFrame::EnsureTextRun 	layout/generic/nsTextFrameThebes.cpp:1871
6 	xul.dll 	xul.dll@0x2f5751 	
7 	xul.dll 	nsLineLayout::ReflowFrame 	layout/generic/nsLineLayout.cpp:853
8 	xul.dll 	nsBlockFrame::ReflowInlineFrame 	layout/generic/nsBlockFrame.cpp:3586

Firefox3.0.3 breakpdad id:
http://crash-stats.mozilla.com/report/index/5c7d5adf-801f-4cbb-93b6-e60ef2081127?p=1

Comment 1

[Martijn Wargers (dead)]

Attachment: binding1 needed for testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase

Comment 3

[Martijn Wargers (dead)]

Attachment: zipped up testcase

Because the bindings need to be loaded, the testcase doesn't crash online, you can make it crash by going offline, or you can use this zipped up testcase.