342922 - crash [@ nsRenderingContextImpl::GetTextDimensions]

Status: VERIFIED FIXED

(Core Graveyard :: GFX, defect)

Description

[Brian Polidoro]

I get a crash when I view this attachment.
https://bugzilla.mozilla.org/attachment.cgi?id=227290

2006062607 ok
2006062704 crashes

It's not cairo specific.

Stack:
nsRenderingContextImpl::GetTextDimensions   
nsTextFrame::MeasureText  
TB20343214G

checkins
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-06-26+07%3A00%3A00&maxdate=2006-06-27+04%3A00%3A00&cvsroot=%2Fcvsroot

I suspect bug 237085.

Comment 1

[Brian Polidoro]

It looks like this also crashes just opening bug 35229. Probably due to comment #1.

Comment 2

[Brian Polidoro]

Attachment: Much better talkback stack

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

thanks for the stack ... the problem is obvious, the patch trivial

Comment 4

[Darin Fisher]

Comment on attachment 227348 [details] [diff] [review]
fix

r+sr=darin

Comment 5

[Mats Palmgren (inactive)]

Shouldn't that be "*aFontID = 0;" like in the other methods?

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in. Thanks

Comment 7

[Brian Polidoro]

Roc

Isn't there a function overloading problem with GetTextDimensions?  The caller that's causing this crash is calling GetTextDimensions with three parameters.  

if (aTx.TransformedTextIsAscii()) {
 aReflowState.rendContext->GetTextDimensions(bp1, wordLen, dimensions);
} else {
 aReflowState.rendContext->GetTextDimensions(bp2, wordLen, dimensions);
}

So it's expecting the first GetTextDimensions to get called.  But the second one is getting called. Thus aFontID is null.

Or am I incorrect somewhere?

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

(In reply to comment #5)
> Shouldn't that be "*aFontID = 0;" like in the other methods?

Yes it should be. However, that is not really a concern.

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

(In reply to comment #7)

There's a default argument of null for aFontID.

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using build 2006-06-28-08 of SeaMonkey trunk under Windows XP with https://bugzilla.mozilla.org/attachment.cgi?id=227290

Comment 11

[Martijn Wargers (dead)]

*** Bug 343088 has been marked as a duplicate of this bug. ***

Comment 12

[timeless]

Comment on attachment 227348 [details] [diff] [review]
fix

well, since the crash was added to the branch too, we kind of need it fixed there too :).

Comment 13

[timeless]

please don't ship with this crash

Comment 14

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Sorry, I should have checked this into the branch myself

Comment 15

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Checked into 1.8.1 branch

Comment 16

[Brian Polidoro]

Verified fixed1.8.1 using build 20060821 Firefox/2.0b2 under Windows XP
with https://bugzilla.mozilla.org/attachment.cgi?id=227290

Comment 17

[Daniel Veditz [:dveditz]]

Restoring lost blocking flag

Comment 18

[Daniel Veditz [:dveditz]]

Not taking bug 237085 in 1.8.0.8 so we don't need this one.