Crash [@ CollectClientRects] with document.createRange().getClientRects()

RESOLVED FIXED in mozilla1.9.3a1

Status

()

--
critical
RESOLVED FIXED
9 years ago
5 years ago

People

(Reporter: martijn.martijn, Assigned: mats)

Tracking

({crash, regression, testcase})

Trunk
mozilla1.9.3a1
x86
Windows XP
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
Created attachment 412960 [details]
testcase

See testcase, which crashes current trunk build on load.
I guess this is a regression from bug 396392.

http://crash-stats.mozilla.com/report/index/e4ce1645-32e0-442b-8e6a-002772091117
0	xul.dll	CollectClientRects
1	xul.dll	nsRange::GetClientRects
2	xul.dll	NS_InvokeByIndex_P
3	xul.dll	XPCWrappedNative::CallMethod
4	xul.dll	XPC_WN_CallMethod
5	mozjs.dll	js_Invoke
6	mozjs.dll	js_Interpret
7	mozjs.dll	js_Execute
8	mozjs.dll	JS_EvaluateUCScriptForPrincipals
9	xul.dll	nsJSContext::EvaluateString
10	xul.dll	nsScriptLoader::EvaluateScript
11	xul.dll	nsScriptLoader::ProcessRequest
12	xul.dll	nsScriptLoader::ProcessScriptElement
(Assignee)

Comment 1

9 years ago
Bug 529670 will fix this case too.
Depends on: 529670
(Assignee)

Comment 2

9 years ago
Fixed by bug 529670.
Assignee: nobody → matspal
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.3a1
Crash Signature: [@ CollectClientRects]
Component: DOM: Traversal-Range → DOM: Core & HTML
Product: Core → Core
You need to log in before you can comment on or make changes to this bug.