597958 - crash [@ gfxTextRun::GetChar(unsigned int) ]

Status: RESOLVED DUPLICATE of bug 597333

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

Build : Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b7pre) Gecko/20100919
Firefox/4.0b7pre

This is a new crash signature that first appeared in b6pre/20100916 build.
It has a daily rate of 1-8 crashes/day
It is #10 top crasher for b7pre/20100919 build.

Signature	gfxTextRun::GetChar(unsigned int)
UUID	51088e38-cff4-4ad0-941e-e34fc2100918
Time 	2010-09-18 15:40:46.546887
Uptime	16114
Last Crash	49140 seconds (13.7 hours) before submission
Install Age	20373 seconds (5.7 hours) since version was first installed.
Product	Firefox
Version	4.0b7pre
Build ID	20100918041706
Branch	2.0
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	AdapterVendorID: 10de, AdapterDeviceID: 0322

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	gfxTextRun::GetChar 	obj-firefox/dist/include/gfxFont.h:1602
1 	xul.dll 	nsTextFrame::PeekOffsetCharacter 	layout/generic/nsTextFrameThebes.cpp:5476
2 	xul.dll 	nsIFrame::PeekOffset 	layout/generic/nsFrame.cpp:5362
3 	xul.dll 	nsFrameSelection::MoveCaret 	layout/generic/nsSelection.cpp:1226
4 	xul.dll 	nsFrameSelection::MoveCaret 	layout/generic/nsSelection.cpp:1092
5 	xul.dll 	nsFrameSelection::CharacterMove 	layout/generic/nsSelection.cpp:2158
6 	xul.dll 	nsTextInputSelectionImpl::CharacterMove 	content/html/content/src/nsTextEditorState.cpp:389
7 	xul.dll 	nsSelectionMoveCommands::DoCommand 	editor/libeditor/base/nsEditorCommands.cpp:722
8 	xul.dll 	nsControllerCommandTable::DoCommand 	embedding/components/commandhandler/src/nsControllerCommandTable.cpp:191
9 	xul.dll 	nsBaseCommandController::DoCommand 	embedding/components/commandhandler/src/nsBaseCommandController.cpp:169
10 	xul.dll 	nsXBLPrototypeHandler::DispatchXBLCommand 	content/xbl/src/nsXBLPrototypeHandler.cpp:496
11 	advapi32.dll 	_alloca_probe 	

The regression range is :
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0caec4ddff74&tochange=f38ef1080bfe

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Rerequest blocking if you get steps to reproduce?

Comment 2

[(no longer active)]

Actually, judging from the crash report, I'm nearly confident that this is a dupe of bug 597333, which has already been resolved.  http://mzl.la/cB0xP3 tells me that we haven't had this crash since the nightlies in which bug 597333 was fixed.  roc, what do you think?  Should I mark this bug as a dupe?

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Yes.