394980 - Crash [@ nsTextFrame::EnsureTextRun] with bidi character and changing displays

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build within 200ms.
This regressed between 2007-08-28 and 2007-08-29.
Regression of bug 384527, somehow, if that makes sense?

http://crash-stats.mozilla.com/report/index/f79768ee-5b58-11dc-9d79-001a4bd43ed6
0  	nsTextFrame::EnsureTextRun(nsIRenderingContext*, nsIFrame*, nsLineList_iterator const*, unsigned int*)  	 mozilla/layout/generic/nsTextFrameThebes.cpp:2002
1 	nsTextFrame::GetPointFromOffset(int, nsPoint*) 	mozilla/layout/generic/nsTextFrameThebes.cpp:4549
2 	nsTypedSelection::GetPointFromOffset(nsIFrame*, int, nsPoint*) 	mozilla/layout/generic/nsSelection.cpp:6988
3 	nsTypedSelection::GetCachedFrameOffset(nsIFrame*, int, nsPoint&) 	mozilla/layout/generic/nsSelection.cpp:5329
4 	nsCaret::UpdateCaretRects(nsIFrame*, int) 	mozilla/layout/base/nsCaret.cpp:1015
5 	nsCaret::DrawAtPositionWithHint(nsIDOMNode*, int, nsFrameSelection::HINT, unsigned char, int) 	mozilla/layout/base/nsCaret.cpp:606
6 	nsCaret::DrawCaret(int) 	mozilla/layout/base/nsCaret.cpp:971
7 	nsCaret::UpdateCaretPosition() 	mozilla/layout/base/nsCaret.cpp:437
8 	PresShell::ProcessReflowCommands(int) 	mozilla/layout/base/nsPresShell.cpp:6146
9 	PresShell::DoFlushPendingNotifications(mozFlushType, int) 	mozilla/layout/base/nsPresShell.cpp:4415
10 	PresShell::WillPaint() 	mozilla/layout/base/nsPresShell.cpp:5803
11 	nsViewManager::FlushPendingInvalidates() 	mozilla/view/src/nsViewManager.cpp:2124
12 	nsViewManager::EnableRefresh(unsigned int) 	mozilla/view/src/nsViewManager.cpp:1838
13 	nsViewManager::EndUpdateViewBatch(unsigned int) 	mozilla/view/src/nsViewManager.cpp:1883
14 	nsCSSFrameConstructor::RestyleEvent::Run() 	mozilla/layout/base/nsCSSFrameConstructor.cpp:13090
15 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:490
16 	NS_ProcessNextEvent_P(nsIThread*, int) 	nsThreadUtils.cpp:227
17 	nsBaseAppShell::Run() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
18 	nsAppStartup::Run() 	mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170
19 	XRE_main 	mozilla/toolkit/xre/nsAppRunner.cpp:3069
20 	main 	mozilla/browser/app/nsBrowserApp.cpp:153
21 	WinMain 	mozilla/browser/app/nsBrowserApp.cpp:166
22 	__tmainCRTStartup 	crtexe.c:589
23 	BaseProcessStart

Comment 1

[Simon Montagu :smontagu]

I don't crash with current trunk, but I see:

###!!! ASSERTION: Gap or overlap in textframes mapping content?!: 'endOfLastCont
ent == contentStart', file c:/mozdev/worktree/mozilla/layout/generic/nsTextFrame
Thebes.cpp, line 1589
JavaScript error: https://bugzilla.mozilla.org/attachment.cgi?id=279683, line 8:
 XML descendants internal method called on incompatible HTMLDivElement
###!!! ASSERTION: Gap or overlap in textframes mapping content?!: 'endOfLastCont
ent == contentStart', file c:/mozdev/worktree/mozilla/layout/generic/nsTextFrame
Thebes.cpp, line 1589

Comment 2

[Martijn Wargers (dead)]

Ah, sorry, you need to have caret browsing turned on to get the crash.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

sounds bad. Simon, do you want this or should I take it?

Comment 4

[Simon Montagu :smontagu]

This looks more like your pigeon. Here's some debug output:

(gdb) fr 6
#6  0xb5a41adc in nsTextFrame::EnsureTextRun (this=0x9107568, aRC=0x0,
    aLineContainer=0x0, aLine=0x0, aFlowEndInTextRun=0x0)
    at /home/smontagu/mozwork/debugtree/mozilla/layout/generic/nsTextFrameThebes.cpp:2007
2007      PRInt32 startAt = userData->mLastFlowIndex;
(gdb) p userData
$1 = (TextRunUserData *) 0x0
$3 = {_vptr.gfxTextRun = 0x8d57898, mCachedWords = 148011688,
  mCharacterGlyphs = {mRawPtr = 0x8de0ab0}, mDetailedGlyphs = {mRawPtr = 0x0},
  mGlyphRuns = {<nsTArray<gfxTextRun::GlyphRun>> = {<nsTArray_base> = {
        static sEmptyHdr = {mLength = 0, mCapacity = 0, mIsAutoArray = 0},
        mHdr = 0x8de0a5c}, <No data fields>},
    mAutoBuf = "\000\000\000\000\001\000\000\200\230s`\b\000\000\000"},
  mText = {mSingle = 0x8de0ac0 "�\n�\bXSK�", mDouble = 0x8de0ac0},
  mUserData = 0x0, mFontGroup = 0x0, mSkipChars = {mList = {
      mRawPtr = 0x845cf10 "�\n�\b\b�E\bX\200�\b\031"}, mShortcuts = {
      mRawPtr = 0x0}, mListLength = 2, mCharCount = 4}, mExpirationState = {
    mGeneration = 15, mIndexInGeneration = 0}, mAppUnitsPerDevUnit = 60,
  mFlags = 4459008, mCharacterCount = 1, mHashCode = 0}

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I don't crash or get an assert on latest trunk. Works for me?

Comment 6

[Martijn Wargers (dead)]

yes, wfm.