264937 - :first-letter causes crash when using RTL direction [@ nsTextFrame::MeasureText]

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Mats Palmgren (inactive)]

:first-letter causes crash when using RTL direction

STEPS TO REPRODUCE:
1. load testcase
2. change to RTL direction, I paste this one-liner in the window:

javascript:(function(){if (document.dir=='rtl') document.dir='ltr'; else
document.dir='rtl';})()

3. resize the window - kaboom


The problem is that we have a frame tree like this:

             parent
firstLetter1   <-   Text1
   ^   |             |
   |   |             |
 prev/next-in-flow   | nextBidi (property)
   |   |             |
   |   v             v
firstLetter2   <-   Text2

Then we hit nsBlockFrame::DeleteNextInFlowChild( ,firstLetter2)
which leaves nextBidi dangling...

The reparenting of Text2 is done by nsFirstLetterFrame::DrainOverflowFrames().
Then nsBidiPresUtils::EnsureBidiContinuation() sets up the nextBidi.

Detecting the situation in DeleteNextInFlowChild and removing nextBidi
fixes the bug but I suspect this is not the fix we want...
I also tried fiddling with EnsureBidiContinuation to avoid the situation in
the first place, but that led to assertions going off and general layout havoc.

Any ideas?

Comment 1

[Mats Palmgren (inactive)]

Attachment: Testcase

Comment 2

[Mats Palmgren (inactive)]

Attachment: Frame dump + crash stack

Comment 3

[Boris Zbarsky [:bzbarsky]]

Note also bug 198928 

Comment 4

[Mats Palmgren (inactive)]

-> default owner

Comment 5

[Uri Bernstein]

Confirming on OS X => All/All

Comment 6

[Ingo Chao]

Attachment: crash with rtl, :firstletter + text zoom increase + window sizing

Don't know if its of interest, the bug is reproducible here in another setting. Simplified testcase2 attached.

Steps to reproduce: 
1. Open the testcase2 in a non-maximized window (the second paragraph content is not visible apart from the first-letter)
2. Increase text zoom by one step (the last line of the first paragraph is overflowing its boundary)
3. Size the window and resize it (Fx crashes)

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051222 Firefox/1.6a1
Mozilla/5.0 (Macintosh; U; PPC MacOS X Mach-O; de, rv:1.8) Gecko/20051111 Firefox/1.5

Comment 7

[Uri Bernstein]

Following the fix of bug 299065, I no longer crash with either of the testcases here. The remaining issues (missing/reversed text) are covered by bug 198928, so I'm resolving this one FIXED.

Comment 8

[(no longer active)]

Mass-assigning the new rtl keyword to RTL-related (see bug 349193).

Comment 9

[Bob Clary [:bc] (inactive)]

layout/generic/crashtests/264937-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3