java.lang.IndexOutOfBoundsException: setSpan (<a> ... <b>) ends beyond length 0

RESOLVED WONTFIX

Status

()

P3
critical
RESOLVED WONTFIX
6 years ago
2 months ago

People

(Reporter: cpeterson, Unassigned)

Tracking

({crash})

Trunk
Firefox 17
ARM
Android
crash
Points:
---

Firefox Tracking Flags

(firefox15 affected, firefox16 affected, firefox17 affected, firefox18 affected)

Details

(Whiteboard: [native-crash], crash signature)

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
This bug was filed from the Socorro interface and is 
report bp-6cab57f1-6c4f-4652-a831-2bb3b2120804 .
============================================================= 

We've seen at least two crash reports where Firefox tries to select a zero-length string. I suspect our call to mEditable.replace(content) is not succeeding, leaving mEditable with a zero-length string.
(Reporter)

Comment 1

6 years ago
Created attachment 649868 [details] [diff] [review]
part-1-select-editable-length.patch

Part 1: Span and select the Editable's actual length (not the length we hope it will be).
Attachment #649868 - Flags: review?(blassey.bugs)
(Reporter)

Comment 2

6 years ago
Created attachment 649870 [details] [diff] [review]
part-2-extract-setSpan-method.patch

Part 2: Extract setSpan() and setSelection() boilerplate into a convenience method.

Also collapse extraneous initEditable() method into GeckoInputConnection's constructor.
Attachment #649870 - Flags: review?(blassey.bugs)

Updated

6 years ago
Duplicate of this bug: 776088
Attachment #649868 - Flags: review?(blassey.bugs) → review+
Attachment #649870 - Flags: review?(blassey.bugs) → review+

Comment 6

6 years ago
https://hg.mozilla.org/mozilla-central/rev/3422d26da179
https://hg.mozilla.org/mozilla-central/rev/8fbaea0f82e8
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED

Updated

6 years ago
status-firefox15: --- → affected
status-firefox16: --- → affected
status-firefox17: affected → fixed
(Reporter)

Updated

6 years ago
Crash Signature: [@ java.lang.IndexOutOfBoundsException: setSpan (0 ... 27299) ends beyond length 0 at android.text.SpannableStringBuilder.checkRange(SpannableStringBuilder.java)] [@ java.lang.IndexOutOfBoundsException: setSpan (0 ... 158084) ends beyond length 0 at andr… → [@ java.lang.IndexOutOfBoundsException: setSpan (0 ... 27299) ends beyond length 0 at android.text.SpannableStringBuilder.checkRange(SpannableStringBuilder.java)] [@ java.lang.IndexOutOfBoundsException: setSpan (0 ... 158084) ends beyond length 0 at andr…
(Reporter)

Comment 7

6 years ago
Comment on attachment 649868 [details] [diff] [review]
part-1-select-editable-length.patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): N/A
User impact if declined: Socorro reports just a few crash reports from Beta 15, Aurora 16, and Nightly 17 users.
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): Low risk because the patch is just double-checking the string length before copying.
String or UUID changes made by this patch: N/A
Attachment #649868 - Flags: approval-mozilla-aurora?
(Reporter)

Comment 8

6 years ago
Patch 2 does not need to be uplifted because it is just a minor refactoring.
Attachment #649868 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
This crash was not reproduced at all on any branch past 4 weeks. I cannot reproduce it either on the latest Nightly. Closing bug as verified fixed.

--
Firefox 18.0a1 (2012-09-17)
Device: Galaxy Note
OS: Android 4.0.4
Status: RESOLVED → VERIFIED
status-firefox16: fixed → verified
status-firefox17: fixed → verified
status-firefox18: --- → verified

Comment 11

6 years ago
(In reply to Cristian Nicolae (:xti) from comment #10)
> This crash was not reproduced at all on any branch past 4 weeks. I cannot
> reproduce it either on the latest Nightly. Closing bug as verified fixed.
I don't understand how you can be sure it's not reproducible without STR and it no longer happens with so many crashes: https://crash-stats.mozilla.com/query/query?product=FennecAndroid&version=ALL%3AALL&query_search=signature&query_type=contains&query=android.text.SpannableStringBuilder.checkRange&do_query=1
Can you clarify that?
(Reporter)

Comment 12

6 years ago
This bug lives again because I backed out the fix (to deal with a regression).
Status: VERIFIED → REOPENED
Resolution: FIXED → ---

Updated

6 years ago
status-firefox16: verified → affected
status-firefox17: verified → affected
status-firefox18: verified → affected
(In reply to Scoobidiver from comment #11)
> Can you clarify that?

I checked the crash reports, on what build number and dates were reported to make sure that everything is fine on m-a and m-c. Since Chris has backed out the fix, it means that's opened again, as already mentioned.

Updated

6 years ago
Whiteboard: [native-crash]
(Reporter)

Updated

5 years ago
Assignee: cpeterson → nobody
Status: REOPENED → NEW
Duplicate of this bug: 1004729
Summary: java.lang.IndexOutOfBoundsException: setSpan (0 ... 27299) ends beyond length 0 → java.lang.IndexOutOfBoundsException: setSpan (<a> ... <b>) ends beyond length 0

Updated

3 years ago
Crash Signature: [@ java.lang.IndexOutOfBoundsException: setSpan (0 ... 27299) ends beyond length 0 at android.text.SpannableStringBuilder.checkRange(SpannableStringBuilder.java)] [@ java.lang.IndexOutOfBoundsException: setSpan (0 ... 158084) ends beyond length 0 at andr… → [@ java.lang.IndexOutOfBoundsException: setSpan (0 ... 27299) ends beyond length 0 at android.text.SpannableStringBuilder.checkRange(SpannableStringBuilder.java)] [@ java.lang.IndexOutOfBoundsException: setSpan (0 ... 158084) ends beyond length 0 at andr…
Closing because no crash reported since 12 weeks.
Status: NEW → RESOLVED
Last Resolved: 6 years ago2 months ago
Resolution: --- → WONTFIX
Closing because no crash reported since 12 weeks.
You need to log in before you can comment on or make changes to this bug.