469356 - Crash [@ BuildTextRunsScanner::FlushFrames(int, int)]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Tony Chung [:tchung]]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4
Build Identifier: 

Crashed on the nightly trying to copy and paste text into bugzilla.   

http://crash-stats.mozilla.com/report/index/ef656443-5a65-4874-bcfa-3eedc2081212

Stack trace:
Frame  	Module  	Signature [Expand]  	Source
0 	XUL 	BuildTextRunsScanner::FlushFrames 	layout/generic/nsTextFrameThebes.cpp:1183
1 	XUL 	nsTextFrame::EnsureTextRun 	layout/generic/nsTextFrameThebes.cpp:1096
2 	XUL 	nsTextFrame::TrimTrailingWhiteSpace 	layout/generic/nsTextFrameThebes.cpp:6117
3 	XUL 	nsLineLayout::TrimTrailingWhiteSpaceIn 	layout/generic/nsLineLayout.cpp:2242
4 	XUL 	nsLineLayout::TrimTrailingWhiteSpaceIn 	layout/generic/nsLineLayout.cpp:2188
5 	XUL 	nsLineLayout::TrimTrailingWhiteSpace 	layout/generic/nsLineLayout.cpp:2309
6 	XUL 	nsBlockFrame::PlaceLine 	layout/generic/nsBlockFrame.cpp:3936
7 	XUL 	nsBlockFrame::DoReflowInlineFrames 	layout/generic/nsBlockFrame.cpp:3549
8 	XUL 	nsBlockFrame::ReflowInlineFrames 	layout/generic/nsBlockFrame.cpp:3261
9 	XUL 	nsBlockFrame::ReflowLine 	layout/generic/nsBlockFrame.cpp:2327
10 	XUL 	nsBlockFrame::ReflowDirtyLines 	layout/generic/nsBlockFrame.cpp:1907
11 	XUL 	nsBlockFrame::Reflow 	layout/generic/nsBlockFrame.cpp:954

Is this a Regression from Dec 13 checkins?

Reproducible: Always

Steps to Reproduce:
1. Open nightly build 
2. copy and paste some text into some form fields (eg. in bugzilla)
3. crash @ BuildTextRunsScanner::FlushFrames(int, int)

Comment 1

[Tony Chung [:tchung]]

The build is actually Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20081212 Minefield/3.2a1pre.  

The useragent id listed in comment 0 is because i had to open this bug on a noncrashy version.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Fixed by backout of 430332?

Comment 3

[Simon Howes]

I can also reproduce this same crash by visiting http://www.macrumors.com/

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Can you retest with a trunk build or tonight's nightly?

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Same happens with the URL given on bug 444375 (http://profiler.noaa.gov/npn/npnWindViewer.jsp). Same on Windows but with a less informative stack:

0  	xul.dll  	gfxTextRun::`vector deleting destructor'  	
1 	xul.dll 	xul.dll@0x3051d6 	
2 		@0x0 	
3 		@0x80000009

Crashes with Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20081212 Minefield/3.2a1pre

Runs fine with Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20081213 Minefield/3.2a1pre

The backout of the patch on bug 430332 has been fixed this crash.

Comment 6

[Tony Chung [:tchung]]

Hasnt crashed since the backout.   Verified on Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20081215 Minefield/3.2a1pre.