"ASSERTION: We're referring different frame" with caret browsing, bidi

RESOLVED FIXED in mozilla23

Status

()

--
minor
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: jruderman, Assigned: mats)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
mozilla23
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

6 years ago
Created attachment 745751 [details]
manual testcase (see comment 0)

1. Load the testcase.
2. Press F6 twice. The content area should now visibly have focus.
3. Press F7 to enable "caret browsing mode".
4. Press Shift, instructing the testcase to call deleteContents().

Result:

###!!! ASSERTION: We're referring different frame: 'frame == aForFrame', file layout/base/nsCaret.cpp, line 518

Masayuki added this assertion long ago in http://hg.mozilla.org/mozilla-central/rev/c746dd4dde4c.
(Reporter)

Comment 1

6 years ago
Created attachment 745752 [details]
stack (gdb)
(Assignee)

Comment 2

6 years ago
Created attachment 746113 [details] [diff] [review]
fix+crashtest

The problem is that nsTextFrame::GetChildFrameContainingOffset
is unstable such that calling it twice with the same arguments
can give different results in some cases.

http://hg.mozilla.org/mozilla-central/annotate/b842d26dd5f0/layout/generic/nsTextFrameThebes.cpp#l6328

The first call stores the resulting frame in OffsetToFrameProperty()
and the next call will start at that frame.  The loop will step to the
next frame if it has the same offset, i.e. the cached frame was empty,
so if there's a sequence of empty continuations we'll get a new result
frame until we reach the last empty frame.

https://tbpl.mozilla.org/?tree=Try&rev=1a650140034c
https://tbpl.mozilla.org/?tree=Try&rev=7e3eabf1b9e4
Assignee: nobody → matspal
Attachment #746113 - Flags: review?(roc)
(Assignee)

Updated

6 years ago
Severity: normal → minor
OS: Linux → All
Hardware: x86_64 → All
Comment on attachment 746113 [details] [diff] [review]
fix+crashtest

Review of attachment 746113 [details] [diff] [review]:
-----------------------------------------------------------------

Nice!
Attachment #746113 - Flags: review?(roc) → review+
https://hg.mozilla.org/mozilla-central/rev/7f1def8c39e8
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
(Reporter)

Updated

5 years ago
Blocks: 894118
You need to log in before you can comment on or make changes to this bug.