288467 - Crash [@ nsTextFrame::MeasureText] with evil testcase (bidi and dynamic -moz-column-count)

Status: VERIFIED FIXED

(Core :: Layout: Form Controls, defect)

Description

[Martijn Wargers (dead)]

This could well be a duplicate of bug 264937 (same backtrace), but just to be sure.

When clicking two times on the button in the testcase, Mozilla crashes.
Talkback ID: TB4735825M

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

Comment 2

[Xanthor Sccas]

Crash also on GNU/Linux with Moz1.8b1 : TB4881447Z

Comment 3

[Uri Bernstein]

Confirmed on OS X => All/All

Comment 4

[Uri Bernstein]

Actually, I don't think this has much to do with 264937, although the eventual crash happens to be in the same place.

Notice that the problem here starts with the first click on the button: there is duplicated and overlapping text everywhere. 

Comment 5

[Uri Bernstein]

Attachment: simple testcase

This testcase doesn't crash, but shows duplicated content.
Notice there is no JS here, and the only thing bidi is the hebrew letter above the divs.
This might not be the only issue involved in the original testcase, but it looks like a good place to start.

Comment 6

[Boris Zbarsky [:bzbarsky]]

mmmm.... columns.

What does the frame dump for that last testcase look like?  Attach it to this bug?

Comment 7

[Uri Bernstein]

Attachment: frame dump

This is a frame dump of attachment 215892 [details].
What I actually see on the screen is:

one two        one two
three four     one two
one two        three four
one two        five

I noticed that although this is what I always get in my latest-trunk Firefox, in my debug SeaMonkey build I originally get:

one two        one two
three four     three four

and only after resizing the window I get what I see in Fx.
The attached frame dump is from after resizing, i.e. it corresponds to the four-row display above.

Comment 8

[Uri Bernstein]

Attachment: frame dump, before resizing

This is a frame dump from my debug SeaMonkey, before resizing (when I only see two lines). Notice the Overflow-lists.

Comment 9

[Boris Zbarsky [:bzbarsky]]

So I suspect this is a columns bug....

Comment 10

[Uri Bernstein]

(In reply to comment #9)
> So I suspect this is a columns bug....
> 

... but it only happens in "bidi mode", so I suspect some bidi code is also involved.

Comment 11

[Adam Guthrie]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20060519 Minefield/3.0a1

WFM. No crash, just lots of assertions.

Comment 12

[Martijn Wargers (dead)]

Yeah, no crash anymore. Crashes in 2006-02-21 build, doesn't crash in 2006-02-22 build, so fixed by bug 299065.
It might be useful to file a bug on the assertions (if there isn't a bug on it, already).

Comment 13

[Martijn Wargers (dead)]

I filed bug 339081 on some change in behavior I see, which changed recently.

Comment 14

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED (for the crash only) with build 2006-05-29-09 of SeaMonkey trunk on Windows XP.