Closed Bug 597333 Opened 9 years ago Closed 9 years ago

Crash [@ gfxTextRun::GetChar][@ nsIFrame::PeekOffset(nsPeekOffsetStruct*) ] when navigating inside a textarea

Categories

(Core :: Editor, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla2.0b7
Tracking Status
blocking2.0 --- final+

People

(Reporter: ehsan, Assigned: ehsan)

References

Details

(Keywords: regression, testcase)

Attachments

(2 files)

blocking2.0: --- → ?
Keywords: testcase-wanted
Unfortunately, I seemed to only reproduce it once (I think it was while drag-selecting, changing displays and pressing the arrow-right key). I won't be able to try and reproduce it any time soon, I'm afraid.
Keywords: qawanted
Ok, this testcase showed the crash that I was seeing. With enhanced privileges enabled, it crashes after 100ms. Otherwise, you have to press the right arrow key to crash.

http://crash-stats.mozilla.com/report/index/ad6eb391-296f-481d-8dc3-b206a2100919
0  	xul.dll  	gfxTextRun::GetChar  	 obj-firefox/dist/include/gfxFont.h:1602
1 	xul.dll 	nsTextFrame::PeekOffsetCharacter 	layout/generic/nsTextFrameThebes.cpp:5476
2 	xul.dll 	nsIFrame::PeekOffset 	layout/generic/nsFrame.cpp:5362
3 	xul.dll 	nsFrameSelection::MoveCaret 	layout/generic/nsSelection.cpp:1226
4 	xul.dll 	nsFrameSelection::MoveCaret 	layout/generic/nsSelection.cpp:1092
5 	xul.dll 	nsFrameSelection::CharacterMove 	layout/generic/nsSelection.cpp:2158
6 	xul.dll 	PresShell::CharacterMove 	layout/base/nsPresShell.cpp:3067
7 	xul.dll 	nsSelectMoveScrollCommand::DoCommandBrowseWithCaretOn 	dom/base/nsGlobalWindowCommands.cpp:303
8 	xul.dll 	nsSelectMoveScrollCommand::DoSelectCommand 	dom/base/nsGlobalWindowCommands.cpp:266
9 	xul.dll 	nsSelectionCommandsBase::DoCommand 	dom/base/nsGlobalWindowCommands.cpp:192
10 	xul.dll 	nsControllerCommandTable::DoCommand 	embedding/components/commandhandler/src/nsControllerCommandTable.cpp:191
11 	xul.dll 	nsBaseCommandController::DoCommand 	embedding/components/commandhandler/src/nsBaseCommandController.cpp:169
12 	xul.dll 	nsXBLPrototypeHandler::DispatchXBLCommand 	content/xbl/src/nsXBLPrototypeHandler.cpp:496
13 	xul.dll 	nsXBLPrototypeHandler::ExecuteHandler
Summary: Crash [@ nsIFrame::PeekOffset(nsPeekOffsetStruct*) ] when navigating inside a textarea → Crash [@ gfxTextRun::GetChar][@ nsIFrame::PeekOffset(nsPeekOffsetStruct*) ] when navigating inside a textarea
Attached patch Patch (v1)Splinter Review
Attachment #476850 - Flags: review?(roc)
Attachment #476850 - Flags: approval2.0?
http://hg.mozilla.org/mozilla-central/rev/925c97269a4c
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.0b7
You need to log in before you can comment on or make changes to this bug.