597333 - Crash [@ gfxTextRun::GetChar][@ nsIFrame::PeekOffset(nsPeekOffsetStruct*) ] when navigating inside a textarea

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect)

Description

[(no longer active)]

See bug 596710 comment 25.

stack:

bp-2aa0ec36-6501-46a7-95c9-cfa272100916

Looks like |current| is being corrupted here for some reason.

http://hg.mozilla.org/mozilla-central/annotate/f38ef1080bfe/layout/generic/nsFrame.cpp#l5364

Comment 1

[Martijn Wargers (dead)]

Unfortunately, I seemed to only reproduce it once (I think it was while drag-selecting, changing displays and pressing the arrow-right key). I won't be able to try and reproduce it any time soon, I'm afraid.

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase (uses enhanced privileges)

Ok, this testcase showed the crash that I was seeing. With enhanced privileges enabled, it crashes after 100ms. Otherwise, you have to press the right arrow key to crash.

http://crash-stats.mozilla.com/report/index/ad6eb391-296f-481d-8dc3-b206a2100919
0  	xul.dll  	gfxTextRun::GetChar  	 obj-firefox/dist/include/gfxFont.h:1602
1 	xul.dll 	nsTextFrame::PeekOffsetCharacter 	layout/generic/nsTextFrameThebes.cpp:5476
2 	xul.dll 	nsIFrame::PeekOffset 	layout/generic/nsFrame.cpp:5362
3 	xul.dll 	nsFrameSelection::MoveCaret 	layout/generic/nsSelection.cpp:1226
4 	xul.dll 	nsFrameSelection::MoveCaret 	layout/generic/nsSelection.cpp:1092
5 	xul.dll 	nsFrameSelection::CharacterMove 	layout/generic/nsSelection.cpp:2158
6 	xul.dll 	PresShell::CharacterMove 	layout/base/nsPresShell.cpp:3067
7 	xul.dll 	nsSelectMoveScrollCommand::DoCommandBrowseWithCaretOn 	dom/base/nsGlobalWindowCommands.cpp:303
8 	xul.dll 	nsSelectMoveScrollCommand::DoSelectCommand 	dom/base/nsGlobalWindowCommands.cpp:266
9 	xul.dll 	nsSelectionCommandsBase::DoCommand 	dom/base/nsGlobalWindowCommands.cpp:192
10 	xul.dll 	nsControllerCommandTable::DoCommand 	embedding/components/commandhandler/src/nsControllerCommandTable.cpp:191
11 	xul.dll 	nsBaseCommandController::DoCommand 	embedding/components/commandhandler/src/nsBaseCommandController.cpp:169
12 	xul.dll 	nsXBLPrototypeHandler::DispatchXBLCommand 	content/xbl/src/nsXBLPrototypeHandler.cpp:496
13 	xul.dll 	nsXBLPrototypeHandler::ExecuteHandler

Comment 3

[(no longer active)]

Attachment: Patch (v1)

Comment 4

[(no longer active)]

http://hg.mozilla.org/mozilla-central/rev/925c97269a4c