167863 - text zoom on arabic pages causes crash [@ ISO10646Convert()]

Status: RESOLVED DUPLICATE of bug 196484

(Core :: Layout: Text and Fonts, defect)

Description

[Dawn Endico]

Go to a page containing arabic. Zoom the text several times.
Eventually it will crash. I tried this on english, japanese
and hebrew pages with no problems. Mozilla crashed with two
different arabic pages. I used 'Ctrl -' and 'Ctrl +' to
zoom.

Comment 1

[Dawn Endico]

the stacks for all three of my crashes look the same.


Incident ID 10722014
Stack Signature ISO10646Convert() 01a6c460
Email Address [e-mail]
Product ID MozillaTrunk
Build ID 2002091008
Trigger Time 2002-09-10 18:47:35
Platform LinuxIntel
Operating System Linux 2.4.7-10
Module libgfx_gtk.so
URL visited arabic web site run by bbc
User Comments resizing fonts on arabic web page causes crash
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Source File Name
/builds/client/linux22/seamonkey/mozilla/gfx/src/gtk/nsFontMetricsGTK.cpp
Trigger Line No. 2080
Stack Trace
ISO10646Convert()
[/builds/client/linux22/seamonkey/mozilla/gfx/src/gtk/nsFontMetricsGTK.cpp, line
2080]
nsFontGTKNormal::GetWidth()
[/builds/client/linux22/seamonkey/mozilla/gfx/src/gtk/nsFontMetricsGTK.cpp, line
2565]
do_BreakGetTextDimensions()
[/builds/client/linux22/seamonkey/mozilla/gfx/src/gtk/nsRenderingContextGTK.cpp,
line 1791]
nsFontMetricsGTK::ResolveForwards()
[/builds/client/linux22/seamonkey/mozilla/gfx/src/gtk/nsFontMetricsGTK.cpp, line
1832]
nsRenderingContextGTK::GetTextDimensions()
[/builds/client/linux22/seamonkey/mozilla/gfx/src/gtk/nsRenderingContextGTK.cpp,
line 1863]
nsTextFrame::MeasureText()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsTextFrame.cpp,
line 4905]
nsTextFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsTextFrame.cpp,
line 5381]
nsLineLayout::ReflowFrame()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1051]
nsInlineFrame::ReflowInlineFrame()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 715]
nsInlineFrame::ReflowFrames()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 527]
nsInlineFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 437]
nsLineLayout::ReflowFrame()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 1051]
nsBlockFrame::ReflowInlineFrame()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3838]
nsBlockFrame::DoReflowInlineFrames()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3706]
nsBlockFrame::DoReflowInlineFramesAuto()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3608]
nsBlockFrame::ReflowInlineFrames()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3554]
nsBlockFrame::ReflowLine()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2625]
nsBlockFrame::ReflowDirtyLines()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2274]
nsBlockFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 949]
nsBlockReflowContext::ReflowBlock()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 536]
nsBlockFrame::ReflowBlockFrame()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3313]
nsBlockFrame::ReflowLine()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2492]
nsBlockFrame::ReflowDirtyLines()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2274]
nsBlockFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 949]
nsBlockReflowContext::ReflowBlock()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 536]
nsBlockFrame::ReflowBlockFrame()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3313]
nsBlockFrame::ReflowLine()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2492]
nsBlockFrame::ReflowDirtyLines()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2274]
nsBlockFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 949]
nsBlockReflowContext::ReflowBlock()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 536]
nsBlockFrame::ReflowBlockFrame()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3313]
nsBlockFrame::ReflowLine()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2492]
nsBlockFrame::ReflowDirtyLines()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2274]
nsBlockFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 949]
nsContainerFrame::ReflowChild()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 790]
nsTableCellFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 448]
nsContainerFrame::ReflowChild()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 790]
nsTableRowFrame::ReflowChildren()
[/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 1047]
nsTableRowFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 1460]
nsContainerFrame::ReflowChild()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 790]
nsTableRowGroupFrame::ReflowChildren()
[/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 444]
nsTableRowGroupFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 1214]
nsContainerFrame::ReflowChild()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 790]
nsTableFrame::ReflowChildren()
[/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 3301]
nsTableFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1999]
nsContainerFrame::ReflowChild()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 790]
nsTableOuterFrame::OuterReflowChild()
[/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 1025]
nsTableOuterFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 1611]
nsBlockReflowContext::ReflowBlock()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 536]
nsBlockFrame::ReflowBlockFrame()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3313]
nsBlockFrame::ReflowLine()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2492]
nsBlockFrame::ReflowDirtyLines()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2274]
nsBlockFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 949]
nsBlockReflowContext::ReflowBlock()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 536]
nsBlockFrame::ReflowBlockFrame()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3313]
nsBlockFrame::ReflowLine()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2492]
nsBlockFrame::ReflowDirtyLines()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2274]
nsBlockFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 949]
nsContainerFrame::ReflowChild()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 790]
CanvasFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsHTMLFrame.cpp,
line 48]
nsBoxToBlockAdaptor::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp,
line 885]
nsBoxToBlockAdaptor::DoLayout()
[/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp,
line 625]
nsBox::Layout()
[/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBox.cpp, line 1064]
nsScrollBoxFrame::DoLayout()
[/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsScrollBoxFrame.cpp,
line 395]
nsBox::Layout()
[/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBox.cpp, line 1064]
nsContainerBox::LayoutChildAt()
[/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 647]
nsGfxScrollFrameInner::LayoutBox()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 1108]
nsGfxScrollFrameInner::Layout()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 1262]
nsGfxScrollFrame::DoLayout()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 1115]
nsBox::Layout()
[/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBox.cpp, line 1064]
nsBoxFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1007]
nsGfxScrollFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 801]
nsContainerFrame::ReflowChild()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 790]
ViewportFrame::Reflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 577]
PresShell::StyleChangeReflow()
[/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp,
line 643]
nsPresContext::ClearStyleDataAndReflow()
[/builds/client/linux22/seamonkey/mozilla/layout/base/src/nsPresContext.cpp,
line 584]
DocumentViewerImpl::SetTextZoom()
[/builds/client/linux22/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp,
line 2298]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
[/builds/client/linux22/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 1994]
XPC_WN_GetterSetter()
[/builds/client/linux22/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1842]
js_Invoke() [/builds/client/linux22/seamonkey/mozilla/js/src/jsinterp.c, line 839]
js_InternalInvoke() [/builds/client/linux22/seamonkey/mozilla/js/src/jsinterp.c,
line 931]
js_Interpret() [/builds/client/linux22/seamonkey/mozilla/js/src/jsinterp.c, line
2645]
js_Invoke() [/builds/client/linux22/seamonkey/mozilla/js/src/jsinterp.c, line 856]
js_InternalInvoke() [/builds/client/linux22/seamonkey/mozilla/js/src/jsinterp.c,
line 931]
js_SetProperty() [/builds/client/linux22/seamonkey/mozilla/js/src/jsobj.c, line
2623]
js_Interpret() [/builds/client/linux22/seamonkey/mozilla/js/src/jsinterp.c, line
2645]
js_Invoke() [/builds/client/linux22/seamonkey/mozilla/js/src/jsinterp.c, line 856]
js_InternalInvoke() [/builds/client/linux22/seamonkey/mozilla/js/src/jsinterp.c,
line 931]
JS_CallFunctionValue() [/builds/client/linux22/seamonkey/mozilla/js/src/jsapi.c,
line 3431]
nsJSContext::CallEventHandler()
[/builds/client/linux22/seamonkey/mozilla/dom/src/base/nsJSEnvironment.cpp, line
1044]
nsJSEventListener::HandleEvent()
[/builds/client/linux22/seamonkey/mozilla/dom/src/events/nsJSEventListener.cpp,
line 182]
nsXBLPrototypeHandler::ExecuteHandler()
[/builds/client/linux22/seamonkey/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp,
line 452]
nsXBLWindowHandler::WalkHandlersInternal()
[/builds/client/linux22/seamonkey/mozilla/content/xbl/src/nsXBLWindowHandler.cpp,
line 312]
nsXBLWindowKeyHandler::WalkHandlers()
[/builds/client/linux22/seamonkey/mozilla/content/xbl/src/nsXBLWindowKeyHandler.cpp,
line 159]
nsXBLWindowKeyHandler::KeyPress()
[/builds/client/linux22/seamonkey/mozilla/content/xbl/src/nsXBLWindowKeyHandler.cpp,
line 199]
nsEventListenerManager::HandleEvent()
[/builds/client/linux22/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1609]
nsXULDocument::HandleDOMEvent()
[/builds/client/linux22/seamonkey/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 2602]
nsXULElement::HandleDOMEvent()
[/builds/client/linux22/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3493]
nsXULElement::HandleDOMEvent()
[/builds/client/linux22/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3493] 

Comment 2

[Dawn Endico]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2a) Gecko/20020910
redhat 7.2

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

This patch fixes the problem for me.  (I noticed it zooming
http://sina.sharif.ac.ir/~roozbeh/index.fa.html .)

Comment 4

[Simon Montagu :smontagu]

I suspect that the root of the problem is in nsTextFrame::MeasureText rather
than in platform-specific code.

Comment 5

[Roland Mainz]

Comment on attachment 99764 [details] [diff] [review]
patch

BTW: The patch needs to be ported to windows, xlib and OS/2 since the matching
code is identical...

Comment 6

[Roland Mainz]

endico:
Does setting % export MOZILLA_GFX_DISABLE_FAST_MEASURE=1 # before starting
Mozilla fix the problem for you ?

Comment 7

[Simon Montagu :smontagu]

Attachment: Minimized test case

The crash is 100% reproducable for me with this test case, but YMMV depending
on installed fonts.

Comment 8

[Dawn Endico]

i'm not crashing on this any more (even without 'export
MOZILLA_GFX_DISABLE_FAST_MEASURE=1'). I tried both
http://news.bbc.co.uk/hi/arabic/news/ and simon's test
case.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2b) Gecko/20021003

Comment 9

[Roland Mainz]

smontagu:
Can we close this bug as DUPlicate of bug 196484 ("HTML table with 2-pixel Arial
makes Mozilla crash [@ nsUnicodeEncodeHelper::ConvertByTable ]") ?

Comment 10

[Simon Montagu :smontagu]

Agreed.

*** This bug has been marked as a duplicate of 196484 ***