342533 - crash loading any MathML page [@ nsSubstring::AssignASCII]

Status: VERIFIED FIXED

(Core :: MathML, defect)

Description

[steve.swanson]

This was caused by the checkin for bug 341954.

Try to open a MathML document.  If you're running a debug build, you'll get an ASSERT.  The next step will be a crash.

	msvcr71d.dll!strlen()  Line 78	Asm
 	xpcom_core.dll!nsSubstring::AssignASCII(const char * data=0x00000000)  Line 343 + 0x9	C++
 	gkgfx.dll!nsFont::nsFont(const char * aName=0x00000000, unsigned char aStyle=0, unsigned char aVariant=0, unsigned short aWeight=0, unsigned char aDecoration=0, int aSize=0, float aSizeAdjust=0.00000000)  Line 50	C++
 	gklayout.dll!InitGlobals(nsPresContext * aPresContext=0x03f48fe8)  Line 1195	C++
 	gklayout.dll!nsMathMLChar::SetData(nsPresContext * aPresContext=0x03f48fe8, nsString & aData={...})  Line 1307 + 0x9	C++
 	gklayout.dll!nsMathMLmoFrame::ProcessTextData(nsPresContext * aPresContext=0x03f48fe8)  Line 234	C++
 	gklayout.dll!nsMathMLTokenFrame::SetInitialChildList(nsIAtom * aListName=0x00000000, nsIFrame * aChildList=0x0411d83c)  Line 124	C++
 	gklayout.dll!nsCSSFrameConstructor::ConstructMathMLFrame(nsFrameConstructorState & aState={...}, nsIContent * aContent=0x040e49b0, nsIFrame * aParentFrame=0x0411d414, nsIAtom * aTag=0x01dd59a0, int aNameSpaceID=7, nsStyleContext * aStyleContext=0x0411d490, nsFrameItems & aFrameItems={...}, int aHasPseudoParent=0)  Line 7323	C++
 	gklayout.dll!nsCSSFrameConstructor::ConstructFrameInternal(nsFrameConstructorState & aState={...}, nsIContent * aContent=0x040e49b0, nsIFrame * aParentFrame=0x0411d414, nsIAtom * aTag=0x01dd59a0, int aNameSpaceID=7, nsStyleContext * aStyleContext=0x0411d490, nsFrameItems & aFrameItems={...}, int aXBLBaseTag=0)  Line 8093 + 0x30	C++
    etc.

Although you could wallpaper the call to AssignASCII(), it might be better to just fix the code in InitGlobals().

Comment 1

[steve.swanson]

Attachment: use a different nsFont constructor in InitGlobals()

One line change to nsMathMLChar.cpp

Comment 2

[Eli Friedman]

*** Bug 343782 has been marked as a duplicate of this bug. ***

Comment 3

[Henri Sivonen (:hsivonen)]

Attachment: Alternative fix

FWIW, this is how I fixed this, when I came across this bug.

Comment 4

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 228470 [details] [diff] [review]
Alternative fix

if you want such a fix then you need to fix the assertion

Comment 5

[Jesse Ruderman]

Happens on Mac too, with a clean profile.

Comment 6

[rbs]

-  nsFont font(nsnull, 0, 0, 0, 0, 0);
+  nsFont font;


Simply change nsnull to "" -- which will keep things identical as before.

Comment 7

[rbs]

Comment on attachment 226797 [details] [diff] [review]
use a different nsFont constructor in InitGlobals()

Updated patch (with "") checked in.

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED; no crash with build 2006-07-21-08 of SeaMonkey trunk under Windows XP on http://www.mozilla.org/projects/mathml/start.xhtml

Comment 9

[rbs]

*** Bug 343209 has been marked as a duplicate of this bug. ***