385430 - Crash in nsTextFrame::Reflow [@ gfxTextRun::CompressedGlyph::IsClusterStart]

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I'm seeing a 100%-reproducable crash in nsTextFrame::Reflow when loading http://www.newyorker.com/reporting/2007/06/04/070604fa_fact_goldberg?printable=true .  If I revert nsTextFrameThebes.cpp from the current 3.40 back to 3.39, it goes away.

I see three assertions preceding the crash:

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /builds/trunk/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /builds/trunk/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
###!!! ASSERTION: Negative flow length?: 'flowEndInTextRun >= transformedOffset', file /builds/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp, line 5277


and then:

#5  <signal handler called>
#6  0x04f0ad07 in gfxTextRun::CompressedGlyph::IsClusterStart (this=0x199a5a40)
    at ../../../dist/include/thebes/gfxFont.h:919
#7  0x0150fa7b in nsTextFrame::Reflow (this=0x19196a90, aPresContext=0x17e6aba0, 
    aMetrics=@0xbfc69150, aReflowState=@0xbfc690a4, aStatus=@0xbfc6924c)
    at /builds/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp:5299

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This seems to be fixed by my patch in bug 385344

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Fixed by checkin for bug 385344