385600 - Crash [@ gfxTextRun::CompressedGlyph::IsClusterStart]

Status: RESOLVED DUPLICATE of bug 385430

(Core :: Layout: Text and Fonts, defect)

Description

[Mats Palmgren (inactive)]

Crash [@ gfxTextRun::CompressedGlyph::IsClusterStart]

STEPS TO REPRODUCE
1. load URL

ACTUAL RESULT
Crash. Let me know if you want details besides the attached stack.
Assertions just before the crash:
###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file gfxSkipChars.cpp, line 92
###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file gfxSkipChars.cpp, line 92
###!!! ASSERTION: Negative flow length?: 'flowEndInTextRun >= transformedOffset', file nsTextFrameThebes.cpp, line 5277


PLATFORMS AND BUILDS TESTED
Bug occurs in a local Firefox debug x86_64 build on Linux (Ubuntu-feisty).
Bug does not occur when running a Firefox nightly build on the same host.

Comment 1

[Mats Palmgren (inactive)]

Attachment: stack

Comment 2

[Jesse Ruderman]

Bug 385430 has the same assertions and stack.

Comment 3

[Mats Palmgren (inactive)]

Sigh, why can't people report the crashing frame in the summary?
I really don't like wasting my time on filing dupes :-(

Comment 4

[Jesse Ruderman]

Sometimes I do text-in-comment searches for stack signatures and assertions to avoid filing dups.  That takes like 30s per search though :(

Comment 5

[Jesse Ruderman]

How is a reftest file crashing not turning Tinderbox orange?

Comment 6

[Mats Palmgren (inactive)]

Bad luck? ;-)   I'm guessing this crash only (or more frequently) occurs
in debug builds, dbaron's crash looks like a 32-bit debug build so the
common factor seems to be debug.  None of the qm-* Tinderboxes appears
to be running a debug build.
I can confirm that the crash disappeared after applying the patch
in bug 385344.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to comment #3)
> Sigh, why can't people report the crashing frame in the summary?

The top of the stack looked bogus, so I wasn't really sure if the reported frame was correct.

Comment 8

[[e-mail]]

If you're here looking for hg changeset bb5cb73eee1a it's in bug 485600...