I accidentally posted this in bug 385344, but this was a different issue, not fixed by bug 385344. Just before I crash, I see this assertion in my debug build: ###!!! ASSERTION: Attempting to allocate excessively large array: 'Error', file c:/mozilla/mozilla/xpcom/build/nsTArray.cpp, line 68
Simon, this is an example of what I was talking about with bidi resolution causing problems with float first-letter. We'll want to land my patch to clean up text offsets before we tackle this one, though.
The testcase doesn't crash anymore. However, when I select the text, weird things happen (wrong selected text, disappearing text).
The testcase still crashes when increasing the font size. I'm not sure in which bug the patch to clean up text offsets is. I guess it hasn't landed yet.
It has landed but there's still a major issue with bidi resolution and floating first-letters.
http://crash-stats.mozilla.com/report/index/0f831eba-50cf-11dc-9735-001a4bd43e5c 0 nsTextFrameUtils::TransformText(unsigned char const*, unsigned int, unsigned char*, int, unsigned char*, gfxSkipCharsBuilder*, unsigned int*) nsTextFrameUtils.cpp:3.8:210 1 BuildTextRunsScanner::BuildTextRunForFrames(void*) nsTextFrameThebes.cpp:3.71:1635 2 BuildTextRunsScanner::FlushFrames(int) nsTextFrameThebes.cpp:3.71:1267 3 shlwapi.dll@0x60064
Depends on: 384527
Summary: Crash with direction: rtl; unicode-bidi: embed; and floating first-letter → Crash [@ nsTextFrameUtils::TransformText] with direction: rtl; unicode-bidi: embed; and floating first-letter
Fixed by bug 384527
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
no crash with the testcase while using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9b3pre) Gecko/2008010104 Minefield/3.0b3pre ID:2008010104 - changing this bug to verified
Status: RESOLVED → VERIFIED
Mass-assigning the new rtl keyword to RTL-related (see bug 349193).
Crash Signature: [@ nsTextFrameUtils::TransformText]
You need to log in before you can comment on or make changes to this bug.