796188 - Crash while caret browsing is trying to move focus

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (see comment 0)

1. Enable caret browsing by pressing F7 or using
     user_pref("accessibility.browsewithcaret", true);
2. Load the testcase
3. Press the down arrow key

In nightly: bp-5fd3f171-b32e-4b49-8d5b-634b82121001

The crash signature [@ nsFrameIterator::GetFirstChild ] matches bug 787822.

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Hubert Figuiere [:hub]]

Adding Trevor, Alex and David as they might have a better idea.

Comment 3

[Scoobidiver (away)]

On Windows: bp-3a068d98-a67a-4e4e-bc8b-e1c4f2121002.

Comment 4

[David Zbarsky (:dzbarsky)]

Fixed by backouts in bug 787822

Comment 5

[Manuela Muntean [Away]]

Going through the steps given in the bug description, the bug doesn't reproduce on Firefox 17 beta 2, for neither one of these platforms: Win 7 64bit, Ubuntu 12.04 32bit and Mac 10.7.5. I checked on Socorro also, and there aren't crashes containing the 2 specified signatures after the date when the fix was provided.

Therefore, I moved the status for firefox17 to verified.

Comment 6

[Manuela Muntean [Away]]

While checking on Socorro, I found crashes that appeared after the fix was made, containing the second signature of the bug: [@ nsIFrame::GetFirstChild(mozilla::layout::FrameChildListID)].

These crashes can be seen here:

https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=nsIFrame%3A%3AGetFirstChild%28mozilla%3A%3Alayout%3A%3AFrameChildListID%29&reason_type=contains&date=11%2F22%2F2012%2008%3A54%3A20&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsIFrame%3A%3AGetFirstChild%28mozilla%3A%3Alayout%3A%3AFrameChildListID%29

Comment 7

[Manuela Muntean [Away]]

After re-checking on Socorro, I didn't find any crashes within last month containing the first signature.  I did find crashes containing the second signature of the bug: [@ nsIFrame::GetFirstChild(mozilla::layout::FrameChildListID)], but none of them on Firefox 18 beta 1 or 2.

Also, the crash isn't reproducible on Firefox 18 beta 2, after going through the steps given in the bug description.

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Build ID: 20121128060531