Crash[@ gfxTextRun::IsRightToLeft() ] on method ragne.getBoundingClientRect()when click selected text of a link

RESOLVED FIXED in mozilla1.9.3a5

Status

()

--
critical
RESOLVED FIXED
9 years ago
6 years ago

People

(Reporter: alice0775, Assigned: mats)

Tracking

({crash, regression, testcase})

Trunk
mozilla1.9.3a5
crash, regression, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

9 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100420 Minefield/3.7a5pre ID:20100420040941
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100420 Minefield/3.7a5pre ID:20100420040941

Crash[@ gfxTextRun::IsRightToLeft() ]

on method ragne.getBoundingClientRect()when i click selected text of a link.

Here, crash report:
bp-2464e09f-1a67-434f-b24c-9987b2100420
bp-8e328c5f-9408-4568-a7e4-ae2942100420
bp-96aab294-d7ff-44b0-9aa1-1575b2100420
bp-0c24991b-bae5-45cf-8d94-16fca2100420
bp-80c3ef28-1221-49c7-8f85-0a1b62100420
bp-adb53fd3-ba5e-4184-9491-d791a2100420

Reproducible: Always

Steps to Reproduce:
1.Start Minefield with New Profile.
2.Open textcase.
3.Select texts by alt + mouse dragging horizontaly from "d" to far right of window.
4.Click on the selected text
5.Click empty area of page
6.Repeat STEP 3 to 5 till browser crashes. (at least 5 times, if necessary)

Actual Results:
 Browser crashes when I click selected text of link.

Expected Results:
 No crash.

Regression Window:

Works:
http://hg.mozilla.org/mozilla-central/rev/338f525fac98
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a4pre) Gecko/20100402 Minefield/3.7a4pre ID:20100402195519

Fails:
http://hg.mozilla.org/mozilla-central/rev/85754ddc898e
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a4pre) Gecko/20100402 Minefield/3.7a4pre ID:20100402211255

Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=338f525fac98&tochange=85754ddc898e

Candidate Bug:
Bug 147777  - :visited support allows queries into global history
(Reporter)

Comment 1

9 years ago
Created attachment 440423 [details]
testcase
We seem to be calling f->GetTextRun() in GetPartialTextRect and getting back null.

I don't see anything that would guarantee a non-null textrun here...
As in, if it worked before, it worked by accident as far as I can see.
Probably just need an EnsureTextRun call
Assignee: nobody → matspal
blocking2.0: --- → ?
(Assignee)

Comment 5

9 years ago
Created attachment 441989 [details] [diff] [review]
Patch rev. 1

Testcase and fix works locally (Linux x86_64).  Testing on TryServer now...
Attachment #441989 - Flags: review?(roc)
(Assignee)

Updated

9 years ago
OS: Windows 7 → All
Hardware: x86 → All
(Assignee)

Comment 6

9 years ago
http://hg.mozilla.org/mozilla-central/rev/5e93ba534a98
Status: NEW → RESOLVED
blocking2.0: ? → ---
Last Resolved: 9 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.3a5
Crash Signature: [@ gfxTextRun::IsRightToLeft() ]
Component: DOM: Traversal-Range → DOM: Core & HTML
Product: Core → Core
You need to log in before you can comment on or make changes to this bug.