667025 - Crash [@ nsTextFrame::ClearTextRun] with rtl

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

bp-4b872138-932e-4dbf-b72b-134d42110624

Regression between Jun 23 and Jun 24 nightly builds, I think.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Mats Palmgren (inactive)]

With nsContainerFrame::RemoveFrame on stack, bug 654002 is the likely culprit.

Comment 3

[Mats Palmgren (inactive)]

Confirmed - reverting bug 654002 in a local build makes the crash go away.

Comment 4

[Mats Palmgren (inactive)]

I suspect that it's the "!mPrevContinuation" on line 3837 that is now
true in cases where it didn't use to be...
http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsTextFrameThebes.cpp#3823

Comment 5

[Mats Palmgren (inactive)]

Attachment: Frame dump + stack

The problem is that ClearAllTextRunReferences() depends on an intact
next-continuation in order to clear mTextRun on the frames.
I think this is worse than the problem bug 654002 was trying to solve,
so I'll just back that out for now.

Comment 6

[Mats Palmgren (inactive)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/12b5e82f6ffd
http://hg.mozilla.org/integration/mozilla-inbound/rev/25c5fc68db1f

Comment 7

[Marco Bonardo [:mak]]

http://hg.mozilla.org/mozilla-central/rev/12b5e82f6ffd
http://hg.mozilla.org/mozilla-central/rev/25c5fc68db1f

Someone please mark bug 654002 as backed out on central since I can't access it.