120047 - crash while loading http://www.lupa.cz/anketa.phtml [@ ReadCMAPTableFormat4]

Status: VERIFIED FIXED

(Core :: Internationalization, defect)

Description

[Adam Hauner]

Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:0.9.7+) Gecko/20020114

Crashing while loading http://www.lupa.cz/anketa.phtml
TB1669681X, TB1669672W, TB1669668M

Comment 1

[Olivier Cahagne]

wfm using build 2002011103 on Win2k.

Comment 2

[Olivier Cahagne]

Stephen, can you retreive Talkback data please ?

Comment 3

[Adam Hauner]

20020111/WinNT4 is also crashing, M097/WinNT4 is okay.

Comment 4

[Junk_HbJ]

Wfm with 2002011403/ Win98SE.

Comment 5

[Erik Hensema]

WFM Linux 2002011421

Comment 6

[Adam Hauner]

WFM 2002011503/WinNT4

Comment 7

[[e-mail] (gone - use [e-mail] instead)]

ReadCMAPTableFormat4
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsFontMetricsWin.cpp, line 1379]
nsFontMetricsWin::GetFontCCMAP
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsFontMetricsWin.cpp, line 1486]
nsFontMetricsWin::GetCCMAP
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsFontMetricsWin.cpp, line 1589]
nsFontMetricsWin::FindGlobalFont
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsFontMetricsWin.cpp, line 2284]
nsFontMetricsWin::FindFont
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsFontMetricsWin.cpp, line 3090]
nsFontMetricsWin::LocateFont
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsFontMetricsWin.cpp, line 3433]

Comment 8

[Matthias Versen [:Matti]]

marking NEW and ->Internationalization
CC : [e-mail] who added many code in file

Comment 9

[Rui Xu]

Reporter:
1. Which version/language's Service Pack are you using on your WinNT4?
2. Have you installed with "Recommended" mode?

Comment 10

[Adam Hauner]

1) I have WinNT's SP6a, but I don't know about any language service packs
installed. With MSIE I installed Pan-European and Japanese Language Supports. If
this is not requested information, tell me how to get it.
2) Installation of what? WinNT? MSIE with language packs? Something else? Always
in custom mode...  

Comment 11

[rbs]

line 1379 where the crash is happening is:

            PRUint16 glyph = idDelta[i] + *g;
>>>crash    if (aIsSpace[glyph]) {
              if (SHOULD_BE_SPACE_CHAR(c)) {
                ADD_GLYPH(aMap, c);
              } 
            }
            else {
              ADD_GLYPH(aMap, c);
            }

This is a little regression from shanjian's attachment 63907 [details] [diff] [review] on bug 118606.
The old code that was moved into the newly added function ReadCMAPTableFormat4()
was testing against maxGlyph first:

-            PRUint16 glyph = idDelta[i] + *g;
-            if (glyph < maxGlyph) {
-              if (isSpace[glyph]) {
-                if (SHOULD_BE_SPACE_CHAR(c)) {
-                  ADD_GLYPH(map, c);
-                }
-              }
-              else {
-                ADD_GLYPH(map, c);
-              }
-            }

So the fix is simply to pass maxGlyph [computed by GetSpaces()] back to the new 
function so as to re-instate the test that used to be there.

Re-assigning to shanjian, and giving r=rbs in anticipation so that the simple 
fix to the regression can go in m0.9.8 without undue procrastination.

[The bug may be hard to reproduce since it depends on the font that happens to 
be used -- I am not hitting bug myself.]

Comment 12

[greer]

Attachment: Windows Trunk info

In comment #11 rbs says "The bug may be hard to reproduce since it depends on
the font that happens to be used." 

Attaching info from today's Trunk reports with a Windows stack and URLs,
including crashing sites to test when we get a fix.

Comment 13

[Shanjian Li]

Attachment: proposed fix

Comment 14

[Shanjian Li]

I could not reproduce the problem on my box, but I believe that is the problem. 
Could somebody who experience the crash help to verify this patch? thanks. 

Comment 15

[Shanjian Li]

Marc, Chris,
Could one of you give sr? 

Comment 16

[Chris Waterson]

Comment on attachment 65271 [details] [diff] [review]
proposed fix

sr=waterson

Comment 17

[Rui Xu]

I tried on JA WinNT4.0 pro + JA SP6a, couldn't repro it.

Reporter: What is your machine's environment? Are you using an EN WinNT4.0 Pro + EN SP6a with Pan-European and Japanese Language Supports? Is it supporting for font only? or for both font and IME? 

Comment 18

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 65271 [details] [diff] [review]
proposed fix

a=dbaron for 0.9.8

Comment 19

[Shanjian Li]

fix checked in. 

Comment 20

[Adam Hauner]

Yep, I'm using EN WinNT4.0 Workstation + EN SP6a with Pan-European and Japanese
Language Supports, Czech language is setted as default locale. Japanese IME I
uninstalled long before this problem. I have also installed Adobe Type Manager
with many fonts, but on reported page are used only common fonts.

Comment 21

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

There were 9 reports of crashes with this stack in the 1-17 builds.

Comment 22

[Shanjian Li]

So the problem is not really fixed. We need to reopen this bug. 
Does anybody has a solid reproducible steps?

Comment 23

[Shanjian Li]

Attachment: An additional patch

Comment 24

[Shanjian Li]

My bad. I only added the assurance judgement in one path not the other. 
This patch should make it complete. seek r/sr/a 

Comment 25

[rbs]

r/sr/a -- I would assume you got all already, no?

Comment 26

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

sure, a=dbaron

Comment 27

[Shanjian Li]

fix checked in. 

Comment 28

[Shanjian Li]

close this bug as fixed.

Comment 29

[Matthias Versen [:Matti]]

*** Bug 120908 has been marked as a duplicate of this bug. ***

Comment 30

[Rui Xu]

I have tried on EN WinNT4.0 Workstation + EN SP6a with Pan-European and Japanese
Language Supports, and selected Czech language as default locale, but still 
cannot repro this bug.

Reporter: could you please try with the latest build, and see if you can still 
repro this bug? Thank you!

Comment 31

[Adam Hauner]

Rui Xu: WFM 2002012103/WinNT4

Comment 32

[Jay Patel [:jay]]

*** Bug 119497 has been marked as a duplicate of this bug. ***

Comment 33

[Rui Xu]

Adam: Thanks a lot for the updates.
Verified.