386476 - Crash [@ nsTextFrameUtils::TransformText] after switching text direction in textarea containing BiDi text

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect, critical)

Description

[dror3go]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a6pre) Gecko/20070630 Minefield/3.0a6pre
Build Identifier: 

Firefox crashes when trying to switch text direction of TEXTAREA containing certain BiDi content.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[dror3go]

Attachment: testcase

Comment 2

[Martijn Wargers (zombie)]

The testcase is wfm, with:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a6pre) Gecko/20070630 Minefield/3.0a6pre

Reporter, the testcase does crash for you, right?
Do you have a breakpad ID?
http://kb.mozillazine.org/Breakpad

In any case, I think this is likely to be a regression from bug 367177.

Comment 3

[dror3go]

> Reporter, the testcase does crash for you, right?
It crash immediately after trying to switch text direction (context menu or CTRL+SHIFT+X) of the textarea.

> Do you have a breakpad ID?
I had to run the testcase many times until the reporter worked (bug 386343).
Here's the crash report:
https://crash-reports.mozilla.com/reports/report/index/83165db3-285a-11dc-9de3-001a4bd46e84?date=2007-07-02-05

Comment 4

[Martijn Wargers (zombie)]

Thanks:
0  	nsTextFrameUtils::TransformText(unsigned short const *,unsigned int,unsigned short *,int,unsigned char *,gfxSkipCharsBuilder *,unsigned int *)
1 	BuildTextRunsScanner::BuildTextRunForFrames(void *)
2 	BuildTextRunsScanner::FlushFrames(int)

Comment 5

[Martijn Wargers (zombie)]

I can see the crash now too with the keyboard, using CTRL+SHIFT+X.

Comment 6

[Jesse Ruderman]

I hit this crash a lot during automated testing.  It confuses Mac OS X Crash Reporter so much that it often puts the crash into something like "e.crash.log" or "dniw).crash.log" instead of "firefox-bin.crash.log"!  My stack is cut off, like Martijn's.  Sometimes it comes with

ASSERTION: Attempting to allocate excessively large array: 'Error', file nsTArray.cpp

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I get an assertion about frame offsets overlapping, so this is probably related to bug 385270.

Comment 8

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Bumping over to roc; close this off if it's fixed by 385270?

Comment 9

[Martijn Wargers (zombie)]

This is working now in:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007081605 Minefield/3.0a8pre
But it was also working in yesterday's build.
So I guess this should be marked worksforme?

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

OK

Comment 11

[Mats Palmgren (:mats)]

crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/72d8423cb0e3

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/72d8423cb0e3