User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100420 Minefield/3.7a5pre ID:20100420040941 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100420 Minefield/3.7a5pre ID:20100420040941 Crash[@ gfxTextRun::IsRightToLeft() ] on method ragne.getBoundingClientRect()when i click selected text of a link. Here, crash report: bp-2464e09f-1a67-434f-b24c-9987b2100420 bp-8e328c5f-9408-4568-a7e4-ae2942100420 bp-96aab294-d7ff-44b0-9aa1-1575b2100420 bp-0c24991b-bae5-45cf-8d94-16fca2100420 bp-80c3ef28-1221-49c7-8f85-0a1b62100420 bp-adb53fd3-ba5e-4184-9491-d791a2100420 Reproducible: Always Steps to Reproduce: 1.Start Minefield with New Profile. 2.Open textcase. 3.Select texts by alt + mouse dragging horizontaly from "d" to far right of window. 4.Click on the selected text 5.Click empty area of page 6.Repeat STEP 3 to 5 till browser crashes. (at least 5 times, if necessary) Actual Results: Browser crashes when I click selected text of link. Expected Results: No crash. Regression Window: Works: http://hg.mozilla.org/mozilla-central/rev/338f525fac98 Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a4pre) Gecko/20100402 Minefield/3.7a4pre ID:20100402195519 Fails: http://hg.mozilla.org/mozilla-central/rev/85754ddc898e Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a4pre) Gecko/20100402 Minefield/3.7a4pre ID:20100402211255 Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=338f525fac98&tochange=85754ddc898e Candidate Bug: Bug 147777 - :visited support allows queries into global history

We seem to be calling f->GetTextRun() in GetPartialTextRect and getting back null. I don't see anything that would guarantee a non-null textrun here...

As in, if it worked before, it worked by accident as far as I can see.

Probably just need an EnsureTextRun call

Testcase and fix works locally (Linux x86_64). Testing on TryServer now...