37757 - crashes with style="font-size: 1px"

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect, P1)

Description

[jlarsen]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win95; en-US; m16) Gecko/20000501
BuildID:    2000050111

Goto www.dwebtech.com
Browser will crash with

MOZILLA caused a divide error in module GKHTML.DLL at 0157:601cd163.
Registers:
EAX=00001af4 CS=0157 EIP=601cd163 EFLGS=00010202
EBX=00000000 SS=015f ESP=0068db00 EBP=0068dd80
ECX=00000014 DS=015f ESI=0068e034 FS=0e4f
EDX=00000000 ES=015f EDI=0068dfd0 GS=0000
Bytes at CS:EIP:
f7 7f 30 89 9d 90 fd ff ff 89 1e 89 45 d4 99 f7
Stack dump:
0068e138 01b7a7e8 00000000 00000000 682dab42 00000000 00011005 00026764 00001005
000000a8 02189360 00f016a7 01a40049 02128400 0068df20 60b02e92

Comment 1

[Jesse Ruderman]

Attachment: testcase: <p style="font-size: 1px">Text</p>

Comment 2

[Asa Dotzler [:asa]]

reassign

Comment 3

[Marc Attinasi]

This looks easy to track - I'll take a look.

Comment 4

[Pierre Saslawsky]

It worked for me on the Mac with builds before and after 2000050111. It also 
worked on Windows but my build was maybe a little bit too old.

Comment 5

[Marc Attinasi]

Testacase and URL both work fin on fresh pull NT build today. 

Marking WORKSFORME 

Comment 6

[jlarsen]

Still crashes on 2000050412 in win98, can someone confirm for a win98/95 machine?
Note this is a fairly new bug it won't produce in older builds in windows.

Comment 7

[Marc Attinasi]

Confirmed on today's daily on Win98. Now I need to get a debug 98 build and 
track it down.

Marking M16, P1

Thanks johnlar.

Comment 8

[Marc Attinasi]

We are crashing because the average char width for the font is 0, and we are 
then using that as the divisor in the TextFrame during a reflow.

Why the average char width is 0 I am not sure, it may have something to do with 
the fact that the font is not a truetype font - I will test with another font (a 
truetype) and see if it matters... However, we probably need to handle the case 
of 0 average char width anyway (at least no divide by it!).

Comment 9

[Marc Attinasi]

Fixed. Changes to nsRenderingContext.cpp and nsTextFrame.cpp to avoid dividing 
by zero when the FontMetrics has 0 for the AvgCharWidth, which only happens on 
Win95/98 (not NT).

Comment 10

[Péter Bajusz]

*** Bug 39186 has been marked as a duplicate of this bug. ***

Comment 11

[ckritzer (gone)]

Marking VERIFED FIXED on:
- MacOS9 2000-05-31-08-M16 Commercial Build
- Linux6 2000-05-31-08-M16 Commercial Build
- Win98  2000-05-31-09-M16 Commercial Build

Comment 12

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/5a6def05ccbc