560780 - Crash[@ gfxTextRun::IsRightToLeft() ] on method ragne.getBoundingClientRect()when click selected text of a link

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Alice0775 White]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100420 Minefield/3.7a5pre ID:20100420040941
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100420 Minefield/3.7a5pre ID:20100420040941

Crash[@ gfxTextRun::IsRightToLeft() ]

on method ragne.getBoundingClientRect()when i click selected text of a link.

Here, crash report:
bp-2464e09f-1a67-434f-b24c-9987b2100420
bp-8e328c5f-9408-4568-a7e4-ae2942100420
bp-96aab294-d7ff-44b0-9aa1-1575b2100420
bp-0c24991b-bae5-45cf-8d94-16fca2100420
bp-80c3ef28-1221-49c7-8f85-0a1b62100420
bp-adb53fd3-ba5e-4184-9491-d791a2100420

Reproducible: Always

Steps to Reproduce:
1.Start Minefield with New Profile.
2.Open textcase.
3.Select texts by alt + mouse dragging horizontaly from "d" to far right of window.
4.Click on the selected text
5.Click empty area of page
6.Repeat STEP 3 to 5 till browser crashes. (at least 5 times, if necessary)

Actual Results:
 Browser crashes when I click selected text of link.

Expected Results:
 No crash.

Regression Window:

Works:
http://hg.mozilla.org/mozilla-central/rev/338f525fac98
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a4pre) Gecko/20100402 Minefield/3.7a4pre ID:20100402195519

Fails:
http://hg.mozilla.org/mozilla-central/rev/85754ddc898e
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a4pre) Gecko/20100402 Minefield/3.7a4pre ID:20100402211255

Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=338f525fac98&tochange=85754ddc898e

Candidate Bug:
Bug 147777  - :visited support allows queries into global history

Comment 1

[Alice0775 White]

Attachment: testcase

Comment 2

[Boris Zbarsky [:bzbarsky]]

We seem to be calling f->GetTextRun() in GetPartialTextRect and getting back null.

I don't see anything that would guarantee a non-null textrun here...

Comment 3

[Boris Zbarsky [:bzbarsky]]

As in, if it worked before, it worked by accident as far as I can see.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Probably just need an EnsureTextRun call

Comment 5

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

Testcase and fix works locally (Linux x86_64).  Testing on TryServer now...

Comment 6

[Mats Palmgren (inactive)]

http://hg.mozilla.org/mozilla-central/rev/5e93ba534a98