52259 - Mozilla crashes when selecting text

Status: RESOLVED WORKSFORME

(Core :: DOM: Selection, defect, P3)

Description

[alla]

When selecting text in the url above (which is a minimal example) mozilla dies
with an assertion:
###!!! ASSERTION: can't find generated content frame: 'lastChildFrame &&
IsGeneratedContentFrame(lastChildFrame)', file nsPresShell.cpp, line 3310
###!!! Break: at file nsPresShell.cpp, line 3310

To repeat, click in the middle of the text, hold down the mousebutton and drag
to the left and right a couple of times.

Here is the top of the backtrace:
#0  NS_NewGeneratedContentIterator (aPresContext=0x84f2f20, aFrame=0x0,
aIterator=0x83edb58) at nsCSSFrameConstructor.cpp:1194
#1  0x412af0d0 in PresShell::GetGeneratedContentIterator (this=0x41d7a288,
aContent=0x41d38900, aType=After, aIterator=0x83edb58) at nsPresShell.cpp:3312
#2  0x4158a5a4 in nsGeneratedContentIterator::GetDeepLastChild (this=0xbfffeea0,
aRoot=0xbfffeea0) at nsGeneratedIterator.cpp:493
#3  0x4158f351 in nsGeneratedSubtreeIterator::Init (this=0x83edb30,
aRange=0x8395070) at nsGeneratedIterator.cpp:1128
#4  0x4158d243 in nsGeneratedSubtreeIterator::Init (this=0x83edb30,
aShell=0x41d7a288, aRange=0x8395070) at nsGeneratedIterator.cpp:937
#5  0x415cbdaf in nsDOMSelection::selectFrames (this=0x41949db0,
aPresContext=0x84f2f20, aRange=0x8395070, aFlags=1) at nsSelection.cpp:3748
#6  0x415d189c in nsDOMSelection::Extend (this=0x41949db0,
aParentNode=0x41d76428, aOffset=4) at nsSelection.cpp:5281
#7  0x415c097e in nsSelection::TakeFocus (this=0x41d3b540, aNewFocus=0x41d76430,
aContentOffset=4, aContentEndOffset=4, aContinueSelection=1,
aMultipleSelection=0)
    at nsSelection.cpp:1789
#8  0x415bfcc1 in nsSelection::HandleClick (this=0x41d3b540,
aNewFocus=0x41d76430, aContentOffset=4, aContentEndOffset=4,
aContinueSelection=1, aMultipleSelection=0, 
    aHint=0) at nsSelection.cpp:1645
#9  0x415c0126 in nsSelection::HandleDrag (this=0x41d3b540,
aPresContext=0x84f2f20, aFrame=0x41decfec, aPoint=@0xbffff658) at
nsSelection.cpp:1701
#10 0x41272223 in nsFrame::HandleDrag (this=0x41decfec, aPresContext=0x84f2f20,
aEvent=0xbffff650, aEventStatus=0xbffff570) at nsFrame.cpp:1366
#11 0x4126e519 in nsFrame::HandleEvent (this=0x41decfec, aPresContext=0x84f2f20,
aEvent=0xbffff650, aEventStatus=0xbffff570) at nsFrame.cpp:774
#12 0x41264ca0 in nsBlockFrame::HandleEvent (this=0x41dece28,
aPresContext=0x84f2f20, aEvent=0xbffff650, aEventStatus=0xbffff570) at
nsBlockFrame.cpp:6552
#13 0x412b0a42 in PresShell::HandleEventInternal (this=0x41d7a288,
aEvent=0xbffff650, aView=0x41df6a70, aStatus=0xbffff570) at nsPresShell.cpp:4197
#14 0x412b06ca in PresShell::HandleEvent (this=0x41d7a288, aView=0x41df6a70,
aEvent=0xbffff650, aEventStatus=0xbffff570, aForceHandle=1,
aHandled=@0xbffff504)
    at nsPresShell.cpp:4117
#15 0x41844b89 in nsView::HandleEvent (this=0x41df6a70, event=0xbffff650,
aEventFlags=28, aStatus=0xbffff570, aForceHandle=1, aHandled=@0xbffff504) at
nsView.cpp:366

Comment 1

[R.K.Aa.]

And the build ID is...?

Comment 2

[alla]

It's a debug build from cvs a few hours ago.

Comment 3

[alla]

I think you need to move the mouse over the <hr> to get the crash.

Comment 4

[Asa Dotzler [:asa]]

over to selection

Comment 5

[Blake Ross]

unable to repro in 2000091312.  alex, is this still happening for you?

Comment 6

[Blake Ross]

*spam*

adding crash keyword...

Comment 7

[alla]

I don't get the crash anymore. Using a current Netscape_20000922_BRANCH branch.

Comment 8

[anthonyd]

i cant repro it either on today's build, marking worksforme.

anthonyd