Closed Bug 560780 Opened 10 years ago Closed 10 years ago

Crash[@ gfxTextRun::IsRightToLeft() ] on method ragne.getBoundingClientRect()when click selected text of a link

Categories

(Core :: DOM: Core & HTML, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla1.9.3a5

People

(Reporter: alice0775, Assigned: mats)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(2 files)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100420 Minefield/3.7a5pre ID:20100420040941
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100420 Minefield/3.7a5pre ID:20100420040941

Crash[@ gfxTextRun::IsRightToLeft() ]

on method ragne.getBoundingClientRect()when i click selected text of a link.

Here, crash report:
bp-2464e09f-1a67-434f-b24c-9987b2100420
bp-8e328c5f-9408-4568-a7e4-ae2942100420
bp-96aab294-d7ff-44b0-9aa1-1575b2100420
bp-0c24991b-bae5-45cf-8d94-16fca2100420
bp-80c3ef28-1221-49c7-8f85-0a1b62100420
bp-adb53fd3-ba5e-4184-9491-d791a2100420

Reproducible: Always

Steps to Reproduce:
1.Start Minefield with New Profile.
2.Open textcase.
3.Select texts by alt + mouse dragging horizontaly from "d" to far right of window.
4.Click on the selected text
5.Click empty area of page
6.Repeat STEP 3 to 5 till browser crashes. (at least 5 times, if necessary)

Actual Results:
 Browser crashes when I click selected text of link.

Expected Results:
 No crash.

Regression Window:

Works:
http://hg.mozilla.org/mozilla-central/rev/338f525fac98
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a4pre) Gecko/20100402 Minefield/3.7a4pre ID:20100402195519

Fails:
http://hg.mozilla.org/mozilla-central/rev/85754ddc898e
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a4pre) Gecko/20100402 Minefield/3.7a4pre ID:20100402211255

Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=338f525fac98&tochange=85754ddc898e

Candidate Bug:
Bug 147777  - :visited support allows queries into global history
Attached file testcase
We seem to be calling f->GetTextRun() in GetPartialTextRect and getting back null.

I don't see anything that would guarantee a non-null textrun here...
As in, if it worked before, it worked by accident as far as I can see.
Probably just need an EnsureTextRun call
Assignee: nobody → matspal
blocking2.0: --- → ?
Attached patch Patch rev. 1Splinter Review
Testcase and fix works locally (Linux x86_64).  Testing on TryServer now...
Attachment #441989 - Flags: review?(roc)
OS: Windows 7 → All
Hardware: x86 → All
http://hg.mozilla.org/mozilla-central/rev/5e93ba534a98
Status: NEW → RESOLVED
blocking2.0: ? → ---
Closed: 10 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.3a5
Crash Signature: [@ gfxTextRun::IsRightToLeft() ]
Component: DOM: Traversal-Range → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.