Closed Bug 385751 Opened 17 years ago Closed 17 years ago

Crash [@ nsTextFrameUtils::TransformText] with direction: rtl; unicode-bidi: embed; and floating first-letter

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: martijn.martijn, Unassigned)

References

(
URL
)

Details

(4 keywords)

Crash Data

I accidentally posted this in bug 385344, but this was a different issue, not fixed by bug 385344.

Just before I crash, I see this assertion in my debug build:
###!!! ASSERTION: Attempting to allocate excessively large array: 'Error', file
c:/mozilla/mozilla/xpcom/build/nsTArray.cpp, line 68
Severity: normal → critical
Simon, this is an example of what I was talking about with bidi resolution causing problems with float first-letter. We'll want to land my patch to clean up text offsets before we tackle this one, though.
The testcase doesn't crash anymore.
However, when I select the text, weird things happen (wrong selected text, disappearing text).
The testcase still crashes when increasing the font size. I'm not sure in which bug  the patch to clean up text offsets is. I guess it hasn't landed yet.
Flags: blocking1.9?
It has landed but there's still a major issue with bidi resolution and floating first-letters.
http://crash-stats.mozilla.com/report/index/0f831eba-50cf-11dc-9735-001a4bd43e5c
0  	nsTextFrameUtils::TransformText(unsigned char const*, unsigned int, unsigned char*, int, unsigned char*, gfxSkipCharsBuilder*, unsigned int*)  	 nsTextFrameUtils.cpp:3.8:210
1 	BuildTextRunsScanner::BuildTextRunForFrames(void*) 	nsTextFrameThebes.cpp:3.71:1635
2 	BuildTextRunsScanner::FlushFrames(int) 	nsTextFrameThebes.cpp:3.71:1267
3 	shlwapi.dll@0x60064
Depends on: 384527
Summary: Crash with direction: rtl; unicode-bidi: embed; and floating first-letter → Crash [@ nsTextFrameUtils::TransformText] with direction: rtl; unicode-bidi: embed; and floating first-letter
Flags: blocking1.9? → blocking1.9+
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Flags: in-testsuite?
Flags: in-testsuite? → in-testsuite+
no crash with the testcase while using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9b3pre) Gecko/2008010104 Minefield/3.0b3pre ID:2008010104 - changing this bug to verified
Status: RESOLVED → VERIFIED
Mass-assigning the new rtl keyword to RTL-related (see bug 349193).
Keywords: rtl
Crash Signature: [@ nsTextFrameUtils::TransformText]
You need to log in before you can comment on or make changes to this bug.