Last Comment Bug 667025 - Crash [@ nsTextFrame::ClearTextRun] with rtl
: Crash [@ nsTextFrame::ClearTextRun] with rtl
Status: RESOLVED FIXED
[inbound]
: crash, regression, testcase
Product: Core
Classification: Components
Component: Layout (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla7
Assigned To: Mats Palmgren (:mats)
:
Mentors:
Depends on:
Blocks: stirdom randomstyles 654002
  Show dependency treegraph
 
Reported: 2011-06-24 12:49 PDT by Jesse Ruderman
Modified: 2013-12-27 14:31 PST (History)
6 users (show)
mats: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (crashes Firefox when loaded) (396 bytes, text/html)
2011-06-24 12:49 PDT, Jesse Ruderman
no flags Details
stack trace (13.25 KB, text/plain)
2011-06-24 12:50 PDT, Jesse Ruderman
no flags Details
Frame dump + stack (12.17 KB, text/html)
2011-06-24 19:24 PDT, Mats Palmgren (:mats)
no flags Details

Description Jesse Ruderman 2011-06-24 12:49:54 PDT
Created attachment 541767 [details]
testcase (crashes Firefox when loaded)

bp-4b872138-932e-4dbf-b72b-134d42110624

Regression between Jun 23 and Jun 24 nightly builds, I think.
Comment 1 Jesse Ruderman 2011-06-24 12:50:18 PDT
Created attachment 541768 [details]
stack trace
Comment 2 Mats Palmgren (:mats) 2011-06-24 14:06:48 PDT
With nsContainerFrame::RemoveFrame on stack, bug 654002 is the likely culprit.
Comment 3 Mats Palmgren (:mats) 2011-06-24 14:13:29 PDT
Confirmed - reverting bug 654002 in a local build makes the crash go away.
Comment 4 Mats Palmgren (:mats) 2011-06-24 14:20:23 PDT
I suspect that it's the "!mPrevContinuation" on line 3837 that is now
true in cases where it didn't use to be...
http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsTextFrameThebes.cpp#3823
Comment 5 Mats Palmgren (:mats) 2011-06-24 19:24:00 PDT
Created attachment 541884 [details]
Frame dump + stack

The problem is that ClearAllTextRunReferences() depends on an intact
next-continuation in order to clear mTextRun on the frames.
I think this is worse than the problem bug 654002 was trying to solve,
so I'll just back that out for now.
Comment 7 Marco Bonardo [::mak] 2011-06-25 03:35:12 PDT
http://hg.mozilla.org/mozilla-central/rev/12b5e82f6ffd
http://hg.mozilla.org/mozilla-central/rev/25c5fc68db1f

Someone please mark bug 654002 as backed out on central since I can't access it.

Note You need to log in before you can comment on or make changes to this bug.