605989 - crash in [@ nsIMEStateManager::GetFocusSelectionAndRoot ] after changing IMEs typing in RTL and then going back to the text using the Form Helper

Status: RESOLVED DUPLICATE of bug 603641

(Firefox for Android Graveyard :: General, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Mozilla/5.0 (Maemo;Linux armv71; rv:2.0b8pre) Gecko/20101020 Firefox/4.0b8pre Fennec/4.0b2pre

1. close the VKB
2. go to people.mozilla.org/~nhirata/html_tp/formsninput.html
3. click in the first text box
4. change the ime and type in arabic to have more than a couple of lines and hit return
5. click on the down arrow in form helper.
6. type in arabic to have more than a couple of lines again and then hit return
7. click on the up arrow in form helper.

Expected : No crash
Actual: related bug 603641 ?  Crash: 
http://crash-stats.mozilla.com/report/index/b5c2e190-7145-4e35-9863-36d9a2101020

 	Source
0 	libxul.so 	nsIMEStateManager::GetFocusSelectionAndRoot 	content/events/src/nsIMEStateManager.cpp:661
1 	libxul.so 	nsContentEventHandler::OnSelectionEvent 	content/events/src/nsContentEventHandler.cpp:934
2 	libxul.so 	nsEventStateManager::PreHandleEvent 	content/events/src/nsEventStateManager.cpp:1393
3 	libxul.so 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6947
4 	libxul.so 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6711
5 	libxul.so 	nsViewManager::HandleEvent 	view/src/nsViewManager.cpp:1092
6 	libxul.so 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1070
7 	libxul.so 	HandleEvent 	view/src/nsView.cpp:161
8 	libxul.so 	mozilla::widget::PuppetWidget::DispatchEvent 	widget/src/xpwidgets/PuppetWidget.cpp:299
9 	libxul.so 	mozilla::widget::PuppetWidget::DispatchEvent 	widget/src/xpwidgets/PuppetWidget.cpp:306
10 	libxul.so 	mozilla::dom::TabChild::DispatchWidgetEvent 	dom/ipc/TabChild.cpp:590
11 	libxul.so 	mozilla::dom::TabChild::RecvSelectionEvent 	dom/ipc/TabChild.cpp:578
12 	libxul.so 	mozilla::dom::PBrowserChild::OnMessageReceived 	PBrowserChild.cpp:1103
13 	libxul.so 	mozilla::dom::PContentChild::OnMessageReceived 	PContentChild.cpp:657
14 	libxul.so 	mozilla::ipc::AsyncChannel::OnDispatchMessage 	ipc/glue/AsyncChannel.cpp:262
15 	libxul.so 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne 	ipc/glue/RPCChannel.cpp:438
16 	libxul.so 	RunnableMethod<mozilla::ipc::RPCChannel,bool ,Tuple0>::Run 	ipc/chromium/src/base/tuple.h:383
17 	libxul.so 	mozilla::ipc::RPCChannel::DequeueTask::Run 	RPCChannel.h:449
18 	libxul.so 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:343
19 	libxul.so 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:351
20 	libxul.so 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:451
21 	libxul.so 	mozilla::ipc::DoWorkRunnable::Run 	ipc/glue/MessagePump.cpp:70
22 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:547
23 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:250
24 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
25 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:229
26 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:219
27 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:202
28 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:180
29 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp:631
30 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:215
31 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:219
32 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:202
33 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp:506
34 	plugin-container 	main 	ipc/app/MozillaRuntimeMain.cpp:78
35 	libc-2.5.so 	libc-2.5.so@0x14973 	
36 	plugin-container 	plugin-container@0x10eb 	
37 	libc-2.5.so 	libc-2.5.so@0x14927

Comment 2

[timeless]

cool, Chrome is just as lame as Safari = WebKit lame