crash [@ nsContentUtils::ComparePoints]

RESOLVED FIXED

Status

()

Core
Selection
P2
critical
RESOLVED FIXED
10 years ago
7 years ago

People

(Reporter: Sylvain Pasche, Assigned: Uri Bernstein (Google))

Tracking

(4 keywords)

Trunk
crash, regression, testcase, verified1.9.1
Points:
---
Bug Flags:
blocking1.9.1 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(4 attachments, 1 obsolete attachment)

(Reporter)

Description

10 years ago
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2a1pre) Gecko/20081218 Minefield/3.2a1pre

open:
http://build.chromium.org/buildbot/perf/dashboard/overview.html

Hold down Shift, click and drag on one of the Canvas.

#0  0xb7f9b430 in __kernel_vsyscall ()
#1  0xb6d13de6 in nanosleep () from /lib/tls/i686/cmov/libc.so.6
#2  0xb6d13bfe in sleep () from /lib/tls/i686/cmov/libc.so.6
#3  0xb7f26b92 in ah_crap_handler (signum=11)
    at /home/sypasche/moz/central/mozilla/toolkit/xre/nsSigHandlers.cpp:149
#4  0xb7f27e50 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:216
#5  <signal handler called>
#6  0xb548c870 in nsINode::GetNodeParent (this=0x0) at ../../../dist/include/content/nsINode.h:530
#7  0xb5761a55 in nsContentUtils::ComparePoints (aParent1=0x0, aOffset1=4396, aParent2=0xb702a20, 
    aOffset2=4, aDisconnected=0x0)
    at /home/sypasche/moz/central/mozilla/content/base/src/nsContentUtils.cpp:1644
#8  0xb55aeb52 in CompareDOMPoints (aParent1=0x0, aOffset1=4396, aParent2=0xb702a40, aOffset2=4)
    at /home/sypasche/moz/central/mozilla/layout/generic/nsSelection.cpp:157
#9  0xb55b0337 in nsFrameSelection::AdjustForMaintainedSelection (this=0xb5d9e00, aContent=0xb702a20, 
    aOffset=4) at /home/sypasche/moz/central/mozilla/layout/generic/nsSelection.cpp:1747
#10 0xb55b0529 in nsFrameSelection::HandleClick (this=0xb5d9e00, aNewFocus=0xb702a20, aContentOffset=4, 
    aContentEndOffset=4, aContinueSelection=1, aMultipleSelection=0, aHint=0)
    at /home/sypasche/moz/central/mozilla/layout/generic/nsSelection.cpp:1797
#11 0xb55b0dc1 in nsFrameSelection::HandleDrag (this=0xb5d9e00, aFrame=0xc72c7b0, aPoint=
      {x = -1079398080, y = -1079396640})
    at /home/sypasche/moz/central/mozilla/layout/generic/nsSelection.cpp:1876
#12 0xb554c5be in nsFrame::HandleDrag (this=0xc72c7b0, aPresContext=0xb5d0248, aEvent=0xbfa9b6e0, 
    aEventStatus=0xbfa9b2a4) at /home/sypasche/moz/central/mozilla/layout/generic/nsFrame.cpp:2262
#13 0xb5537d74 in nsFrame::HandleEvent (this=0xc72c7b0, aPresContext=0xb5d0248, aEvent=0xbfa9b6e0, 
    aEventStatus=0xbfa9b2a4) at /home/sypasche/moz/central/mozilla/layout/generic/nsFrame.cpp:1641
#14 0xb55010ff in nsPresShellEventCB::HandleEvent (this=0xbfa9b350, aVisitor=@0xbfa9b298)
    at /home/sypasche/moz/central/mozilla/layout/base/nsPresShell.cpp:1255
#15 0xb5878e87 in nsEventTargetChainItem::HandleEventTargetChain (this=0xc155d88, aVisitor=@0xbfa9b298, 
    aFlags=6, aCallback=0xbfa9b350, aMayHaveNewListenerManagers=1)
    at /home/sypasche/moz/central/mozilla/content/events/src/nsEventDispatcher.cpp:337
(Reporter)

Comment 1

10 years ago
also happens on 1.9.1 branch.

Comment 2

10 years ago
Japp, crash from todays SeaMonkey-Win-Nightly (1.9.1 branch):
bp-a5106225-d8b5-45d4-b0df-07b3c2081218

Updated

10 years ago
Severity: normal → critical

Comment 3

10 years ago
Possibly regression from Bug 415707? Could anyone verify?
(Reporter)

Comment 4

10 years ago
That's very likely according to the regression range:
bug 415707 was pushed on Fri Oct 17 21:46:33 2008

build from 20081017: ok
build from 20081018: crashes
Blocks: 415707
Keywords: regression
Flags: blocking1.9.1?
(Assignee)

Updated

10 years ago
Assignee: nobody → uriber
Component: DOM → Selection
QA Contact: general → selection
(Reporter)

Comment 5

10 years ago
Created attachment 353739 [details]
testcase

A somewhat reduced testcase.
(Reporter)

Updated

10 years ago
Keywords: testcase-wanted → testcase
Created attachment 353742 [details]
testcase2 (uses enhanced privileges)

This testcase uses enhanced privileges and should crash in that case in 200ms.
(Assignee)

Comment 7

10 years ago
Created attachment 353953 [details] [diff] [review]
patch

Restore the previous behavior where MaintainSelection() failed when the current selection is empty, so that mMaintainedRange is either null or non-empty.
Attachment #353953 - Flags: superreview?(roc)
Attachment #353953 - Flags: review?(mats.palmgren)
Attachment #353953 - Flags: superreview?(roc) → superreview+
Comment on attachment 353953 [details] [diff] [review]
patch

I think Martijn's latest test could be turned into a mochitest

Comment 9

10 years ago
I think returning NS_OK is better.  Having no anchor/focus node is valid
and mMaintainedRange==nsnull is the correct state in that case, isn't it?

Also, the "mMaintainRange = nsnull" might be better to do earlier (after
the mMaintainedAmount assignment), so if any of the NS_ENSURE_SUCCESS
fails it is null.
(Assignee)

Comment 10

10 years ago
Created attachment 354626 [details] [diff] [review]
patch v2

Modified per comments.
Attachment #353953 - Attachment is obsolete: true
Attachment #354626 - Flags: review?(mats.palmgren)
Attachment #353953 - Flags: review?(mats.palmgren)
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2
Comment on attachment 354626 [details] [diff] [review]
patch v2

r=mats
Attachment #354626 - Flags: review?(mats.palmgren) → review+
Uri, do you want to check this in yourself? Or should we go for checkin-needed?
(Assignee)

Comment 13

10 years ago
I'm pretty short on time these days, adding checkin-needed.
Keywords: checkin-needed
http://hg.mozilla.org/mozilla-central/rev/bfb2d513344d

-> FIXED
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Flags: in-testsuite?
Keywords: checkin-needed
Resolution: --- → FIXED
checkin-needed for 1.9.1 too?
Whiteboard: [needs 1.9.1 landing]

Updated

10 years ago
Summary: crash @nsContentUtils::ComparePoints → crash [@ nsContentUtils::ComparePoints]
Created attachment 358859 [details] [diff] [review]
mochitest

I've verified that this test crashes prior to the check-in of the patch.
Pushed Martijn's test:
http://hg.mozilla.org/mozilla-central/rev/14b8b7294044
Flags: in-testsuite? → in-testsuite+
Pushed the fix and the test to 1.9.1:
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/360b9713dd27
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/63c1f52ef2f5
Keywords: fixed1.9.1
Whiteboard: [needs 1.9.1 landing]
Verified fixed on the 1.9.1 branch using  Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090414 Shiretoko/3.5b4pre and  Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4pre) Gecko/20090414 Shiretoko/3.5b4pre. No crashes with testcase.
Keywords: fixed1.9.1 → verified1.9.1
Crash Signature: [@ nsContentUtils::ComparePoints]
You need to log in before you can comment on or make changes to this bug.