376615 - Crash loading bookmark folder from bookmarks toolbar when data:text/html,%F0%90%8F%BF is loaded in a tab [@ gfxTextRun::GetAdvanceWidth]

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect)

Description

[dolphinling]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a4pre) Gecko/20070404 Minefield/3.0a4pre ID:2007040404 [cairo]

When data:text/html,%F0%90%8F%BF is loaded in a tab, loading all tabs from a folder in the bookmarks toolbar (by middle clicking or clicking Open All in Tabs) crashes firefox.

The data: url does not need to be the active tab. I haven't tried other data:urls. Opening a folder from the bookmarks menu does NOT crash. 

Some talkbacks:
TB30915020
TB30915001
TB30914994
TB30914940
TB30914832

Comment 1

[dolphinling]

Still present in last night's nightly (Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a4pre) Gecko/20070405 Minefield/3.0a4pre ID:2007040504 [cairo]) but I notice a checkin in bonsai that looks related 

http://bonsai-stage.mozilla.org/cvsquery.cgi?date=explicit&mindate=2007-04-05+06%3A36&maxdate=2007-04-05+06%3A36

so should test again tomorrow.

Comment 2

[Adam Guthrie]

Incident ID: 30915020
Stack Signature	gfxTextRun::GetAdvanceWidth(unsigned, unsigned, gfxTextRun::PropertyProvider*)() ffcdee51
Product ID	FirefoxTrunk
Build ID	2007040404
Trigger Time	2007-04-05 08:58:57.0
Platform	LinuxIntel
Operating System	Linux 2.6.18.6
Module	firefox-bin + (00758178)
URL visited	
User Comments	
Since Last Crash	0 sec
Total Uptime	1 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.	/builds/tinderbox/Fx-Trunk-Cairo/Linux_2.4.21-32.0.1.EL_Depend/mozilla/gfx/thebes/src/gfxFont.cpp, line 574
Stack Trace 	
gfxTextRun::GetAdvanceWidth(unsigned, unsigned, gfxTextRun::PropertyProvider*)()  [mozilla/gfx/thebes/src/gfxFont.cpp, line 574]
nsThebesFontMetrics::GetWidth()  [mozilla/gfx/src/thebes/nsThebesFontMetrics.cpp, line 179]
nsThebesRenderingContext::GetWidthInternal()  [mozilla/gfx/src/thebes/nsThebesRenderingContext.cpp, line 846]
nsRenderingContextImpl::GetWidth()  [mozilla/gfx/src/shared/nsRenderingContextImpl.cpp, line 525]
nsThebesRenderingContext::GetWidth()  [mozilla/gfx/src/thebes/nsThebesRenderingContext.cpp, line 1068]
nsTextBoxFrame::CalculateTitleForWidth()  [mozilla/layout/xul/base/src/nsTextBoxFrame.cpp, line 690]
nsTextBoxFrame::LayoutTitle()  [mozilla/layout/xul/base/src/nsTextBoxFrame.cpp, line 497]
nsTextBoxFrame::PaintTitle()  [mozilla/layout/xul/base/src/nsTextBoxFrame.cpp, line 333]
nsDisplayXULTextBox::Paint()  [mozilla/layout/xul/base/src/nsTextBoxFrame.cpp, line 187]
nsDisplayList::Paint()  [mozilla/layout/base/nsDisplayList.cpp, line 449]
nsDisplayClip::Paint()  [mozilla/layout/base/nsDisplayList.cpp, line 940]
nsDisplayList::Paint()  [mozilla/layout/base/nsDisplayList.cpp, line 449]
nsDisplayClip::Paint()  [mozilla/layout/base/nsDisplayList.cpp, line 940]
nsDisplayList::Paint()  [mozilla/layout/base/nsDisplayList.cpp, line 449]
nsLayoutUtils::PaintFrame()  [mozilla/layout/base/nsLayoutUtils.cpp, line 819]
PresShell::Paint()  [mozilla/layout/base/nsPresShell.cpp, line 5383]
nsViewManager::RenderViews()  [mozilla/view/src/nsViewManager.cpp, line 670]
nsViewManager::Refresh()  [mozilla/view/src/nsViewManager.cpp, line 1061]
nsViewManager::DispatchEvent()  [mozilla/view/src/nsViewManager.cpp, line 840]
HandleEvent()  [mozilla/view/src/nsView.cpp, line 168]
nsCommonWidget::DispatchEvent()  [mozilla/widget/src/gtk2/nsCommonWidget.cpp, line 220]
nsWindow::OnExposeEvent()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 1736]
expose_event_cb()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 4278]
libgtk-x11-2.0.so.0 + 0x1248ce (0xb7bc08ce)

Comment 3

[Martijn Wargers (dead)]

dolphinling, you're still seeing this in today's trunk build?

Comment 4

[dolphinling]

I AM still seeing this in today's trunk build. Talkback TB31481755.

Comment 5

[dolphinling]

This was fixed by something.