391237 - Crash gfxSkipCharsIterator::SetOffsets (this=0xbff7e09c, aOffset=1003, aInOriginalString=1)

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Igor Bukanov]

With the browser build as of 2007-08-07 on the URL I am getting crashes on Linux either immediately or when going to pages 2,3,4,5 of the article. The following stack trace is:

#0  0x039e2e9e in gfxSkipCharsIterator::SetOffsets (this=0xbff7e09c, aOffset=1003, aInOriginalString=1) at /home/igor/m/trunk/mozilla/gfx/thebes/src/gfxSkipChars.cpp:129
#1  0x01bbe2e9 in gfxSkipCharsIterator::AdvanceOriginal (this=0xbff7e09c, aDelta=478) at ../../dist/include/thebes/gfxSkipChars.h:296
#2  0x01bb66dd in BuildTextRunsScanner::SetupBreakSinksForTextRun (this=0xbff804dc, aTextRun=0xb328870, aIsExistingTextRun=0, aSuppressSink=0) at /home/igor/m/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp:1892
#3  0x01bb75c9 in BuildTextRunsScanner::BuildTextRunForFrames (this=0xbff804dc, aTextBuffer=0xbff7f648) at /home/igor/m/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp:1787
#4  0x01bb7b29 in BuildTextRunsScanner::FlushFrames (this=0xbff804dc, aFlushLineBreaks=1) at /home/igor/m/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp:1253
#5  0x01bb8569 in BuildTextRuns (aRC=<value optimized out>, aForFrame=0xa7bb774, aLineContainer=<value optimized out>, aForFrameLine=0xbff80e6c) at /home/igor/m/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp:1212
#6  0x01bb8614 in nsTextFrame::EnsureTextRun (this=0xa7bb774, aRC=0xab28b20, aLineContainer=0xa7bcb44, aLine=0xbff80e6c, aFlowEndInTextRun=0xbff80ac4) at /home/igor/m/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp:1969
#7  0x01bb929e in nsTextFrame::Reflow (this=0xa7bb774, aPresContext=0xa434ed0, aMetrics=@0xbff80c4c, aReflowState=@0xbff80ba0, aStatus=@0xbff80d24) at /home/igor/m/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp:5285
#8  0x01b849e4 in nsLineLayout::ReflowFrame (this=0xbff80e1c, aFrame=0xa7bb774, aReflowStatus=@0xbff80d24, aMetrics=0x0, aPushedFrame=@0xbff80d20) at /home/igor/m/trunk/mozilla/layout/generic/nsLineLayout.cpp:901
#9  0x01b3118f in nsBlockFrame::ReflowInlineFrame (this=0xa7bcb44, aState=@0xbff81220, aLineLayout=@0xbff80e1c, aLine={mCurrent = 0xa7bcb9c, mListLink = 0xa7bcb84}, aFrame=0xa7bb774, aLineReflowStatus=0xbff80dac) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:3525
#10 0x01b32313 in nsBlockFrame::DoReflowInlineFrames (this=0xa7bcb44, aState=@0xbff81220, aLineLayout=@0xbff80e1c, aLine={mCurrent = 0xa7bcb9c, mListLink = 0xa7bcb84}, aKeepReflowGoing=0xbff8113c, aLineReflowStatus=0xbff80ee8, aAllowPullUp=1) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:3345
#11 0x01b32980 in nsBlockFrame::ReflowInlineFrames (this=0xa7bcb44, aState=@0xbff81220, aLine={mCurrent = 0xa7bcb9c, mListLink = 0xa7bcb84}, aKeepReflowGoing=0xbff8113c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:3189
#12 0x01b33eb9 in nsBlockFrame::ReflowLine (this=0xa7bcb44, aState=@0xbff81220, aLine={mCurrent = 0xb33be88, mListLink = 0xa7bcb84}, aKeepReflowGoing=0xbff8113c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2222
#13 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0xa7bcb44, aState=@0xbff81220) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#14 0x01b365e3 in nsBlockFrame::Reflow (this=0xa7bcb44, aPresContext=0xa434ed0, aMetrics=@0xbff818ac, aReflowState=@0xbff817bc, aStatus=@0xbff8193c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#15 0x01b3a6d8 in nsBlockReflowContext::ReflowBlock (this=0xbff81868, aSpace=@0xbff81908, aApplyTopMargin=1, aPrevMargin=@0xbff81d60, aClearance=0, aIsAdjacentWithTop=0, aComputedOffsets=@0xbff818f8, aFrameRS=@0xbff817bc, aFrameReflowStatus=@0xbff8193c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowContext.cpp:370
#16 0x01b331c2 in nsBlockFrame::ReflowBlockFrame (this=0x9dd5848, aState=@0xbff81ce0, aLine={mCurrent = 0xa7bd0e8, mListLink = 0x9dd5888}, aKeepReflowGoing=0xbff81bfc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2926
#17 0x01b33d22 in nsBlockFrame::ReflowLine (this=0x9dd5848, aState=@0xbff81ce0, aLine={mCurrent = 0xb33be88, mListLink = 0x9dd5888}, aKeepReflowGoing=0xbff81bfc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2169
#18 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0x9dd5848, aState=@0xbff81ce0) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#19 0x01b365e3 in nsBlockFrame::Reflow (this=0x9dd5848, aPresContext=0xa434ed0, aMetrics=@0xbff8236c, aReflowState=@0xbff8227c, aStatus=@0xbff823fc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#20 0x01b3a6d8 in nsBlockReflowContext::ReflowBlock (this=0xbff82328, aSpace=@0xbff823c8, aApplyTopMargin=0, aPrevMargin=@0xbff82820, aClearance=0, aIsAdjacentWithTop=1, aComputedOffsets=@0xbff823b8, aFrameRS=@0xbff8227c, aFrameReflowStatus=@0xbff823fc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowContext.cpp:370
#21 0x01b331c2 in nsBlockFrame::ReflowBlockFrame (this=0xa7bd250, aState=@0xbff827a0, aLine={mCurrent = 0xa7bd2a8, mListLink = 0xa7bd290}, aKeepReflowGoing=0xbff826bc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2926
#22 0x01b33d22 in nsBlockFrame::ReflowLine (this=0xa7bd250, aState=@0xbff827a0, aLine={mCurrent = 0xb33be88, mListLink = 0xa7bd290}, aKeepReflowGoing=0xbff826bc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2169
#23 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0xa7bd250, aState=@0xbff827a0) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#24 0x01b365e3 in nsBlockFrame::Reflow (this=0xa7bd250, aPresContext=0xa434ed0, aMetrics=@0xbff82e2c, aReflowState=@0xbff82d3c, aStatus=@0xbff82ebc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#25 0x01b3a6d8 in nsBlockReflowContext::ReflowBlock (this=0xbff82de8, aSpace=@0xbff82e88, aApplyTopMargin=0, aPrevMargin=@0xbff832e0, aClearance=0, aIsAdjacentWithTop=1, aComputedOffsets=@0xbff82e78, aFrameRS=@0xbff82d3c, aFrameReflowStatus=@0xbff82ebc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowContext.cpp:370
#26 0x01b331c2 in nsBlockFrame::ReflowBlockFrame (this=0x9dd55bc, aState=@0xbff83260, aLine={mCurrent = 0xa7bd330, mListLink = 0x9dd55fc}, aKeepReflowGoing=0xbff8317c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2926
#27 0x01b33d22 in nsBlockFrame::ReflowLine (this=0x9dd55bc, aState=@0xbff83260, aLine={mCurrent = 0xb33be88, mListLink = 0x9dd55fc}, aKeepReflowGoing=0xbff8317c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2169
#28 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0x9dd55bc, aState=@0xbff83260) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#29 0x01b365e3 in nsBlockFrame::Reflow (this=0x9dd55bc, aPresContext=0xa434ed0, aMetrics=@0xbff838ec, aReflowState=@0xbff837fc, aStatus=@0xbff8397c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#30 0x01b3a6d8 in nsBlockReflowContext::ReflowBlock (this=0xbff838a8, aSpace=@0xbff83948, aApplyTopMargin=1, aPrevMargin=@0xbff83da0, aClearance=0, aIsAdjacentWithTop=0, aComputedOffsets=@0xbff83938, aFrameRS=@0xbff837fc, aFrameReflowStatus=@0xbff8397c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowContext.cpp:370
#31 0x01b331c2 in nsBlockFrame::ReflowBlockFrame (this=0xa6abfb4, aState=@0xbff83d20, aLine={mCurrent = 0xa7be374, mListLink = 0xa6abff4}, aKeepReflowGoing=0xbff83c3c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2926
#32 0x01b33d22 in nsBlockFrame::ReflowLine (this=0xa6abfb4, aState=@0xbff83d20, aLine={mCurrent = 0xb33be88, mListLink = 0xa6abff4}, aKeepReflowGoing=0xbff83c3c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2169
#33 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0xa6abfb4, aState=@0xbff83d20) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#34 0x01b365e3 in nsBlockFrame::Reflow (this=0xa6abfb4, aPresContext=0xa434ed0, aMetrics=@0xbff843ac, aReflowState=@0xbff842bc, aStatus=@0xbff8443c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#35 0x01b3a6d8 in nsBlockReflowContext::ReflowBlock (this=0xbff84368, aSpace=@0xbff84408, aApplyTopMargin=0, aPrevMargin=@0xbff84860, aClearance=0, aIsAdjacentWithTop=1, aComputedOffsets=@0xbff843f8, aFrameRS=@0xbff842bc, aFrameReflowStatus=@0xbff8443c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowContext.cpp:370
#36 0x01b331c2 in nsBlockFrame::ReflowBlockFrame (this=0xa6abe94, aState=@0xbff847e0, aLine={mCurrent = 0xa6ac65c, mListLink = 0xa6abed4}, aKeepReflowGoing=0xbff846fc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2926
#37 0x01b33d22 in nsBlockFrame::ReflowLine (this=0xa6abe94, aState=@0xbff847e0, aLine={mCurrent = 0xb33be88, mListLink = 0xa6abed4}, aKeepReflowGoing=0xbff846fc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2169
#38 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0xa6abe94, aState=@0xbff847e0) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#39 0x01b365e3 in nsBlockFrame::Reflow (this=0xa6abe94, aPresContext=0xa434ed0, aMetrics=@0xbff84e6c, aReflowState=@0xbff84d7c, aStatus=@0xbff84efc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#40 0x01b3a6d8 in nsBlockReflowContext::ReflowBlock (this=0xbff84e28, aSpace=@0xbff84ec8, aApplyTopMargin=1, aPrevMargin=@0xbff85320, aClearance=0, aIsAdjacentWithTop=1, aComputedOffsets=@0xbff84eb8, aFrameRS=@0xbff84d7c, aFrameReflowStatus=@0xbff84efc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowContext.cpp:370
#41 0x01b331c2 in nsBlockFrame::ReflowBlockFrame (this=0xa6abd3c, aState=@0xbff852a0, aLine={mCurrent = 0xa6ac6ac, mListLink = 0xa6abd7c}, aKeepReflowGoing=0xbff851bc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2926
#42 0x01b33d22 in nsBlockFrame::ReflowLine (this=0xa6abd3c, aState=@0xbff852a0, aLine={mCurrent = 0xb33be88, mListLink = 0xa6abd7c}, aKeepReflowGoing=0xbff851bc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2169
#43 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0xa6abd3c, aState=@0xbff852a0) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#44 0x01b365e3 in nsBlockFrame::Reflow (this=0xa6abd3c, aPresContext=0xa434ed0, aMetrics=@0xbff85818, aReflowState=@0xbff85728, aStatus=@0xbff85ca4) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#45 0x01b3a6d8 in nsBlockReflowContext::ReflowBlock (this=0xbff857d4, aSpace=@0xbff85858, aApplyTopMargin=1, aPrevMargin=@0xbff85868, aClearance=0, aIsAdjacentWithTop=0, aComputedOffsets=@0xbff85848, aFrameRS=@0xbff85728, aFrameReflowStatus=@0xbff85ca4) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowContext.cpp:370
#46 0x01b2c63d in nsBlockFrame::ReflowFloat (this=0xa655740, aState=@0xbff861a0, aPlaceholder=0xa6abd94, aFloatMargin=@0xbff85954, aReflowStatus=@0xbff85ca4) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:5483
#47 0x01b3b85d in nsBlockReflowState::FlowAndPlaceFloat (this=0xbff861a0, aFloatCache=0xa6b7c80, aIsLeftFloat=0xbff85a74, aReflowStatus=@0xbff85ca4, aForceFit=0) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowState.cpp:749
#48 0x01b3c561 in nsBlockReflowState::AddFloat (this=0xbff861a0, aLineLayout=@0xbff85d9c, aPlaceholder=0xa6abd94, aInitialReflow=0, aReflowStatus=@0xbff85ca4) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowState.cpp:549
#49 0x01b85f8a in nsLineLayout::AddFloat (this=0xbff85d9c, aFrame=0xa6abd94, aReflowStatus=@0xbff85ca4) at /home/igor/m/trunk/mozilla/layout/generic/nsLineLayout.h:255
#50 0x01b84ac0 in nsLineLayout::ReflowFrame (this=0xbff85d9c, aFrame=0xa6abd94, aReflowStatus=@0xbff85ca4, aMetrics=0x0, aPushedFrame=@0xbff85ca0) at /home/igor/m/trunk/mozilla/layout/generic/nsLineLayout.cpp:925
#51 0x01b3118f in nsBlockFrame::ReflowInlineFrame (this=0xa655740, aState=@0xbff861a0, aLineLayout=@0xbff85d9c, aLine={mCurrent = 0xa6ac724, mListLink = 0xa655780}, aFrame=0xa6abd94, aLineReflowStatus=0xbff85d2c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:3525
#52 0x01b32313 in nsBlockFrame::DoReflowInlineFrames (this=0xa655740, aState=@0xbff861a0, aLineLayout=@0xbff85d9c, aLine={mCurrent = 0xa6ac724, mListLink = 0xa655780}, aKeepReflowGoing=0xbff860bc, aLineReflowStatus=0xbff85e68, aAllowPullUp=1) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:3345
#53 0x01b32980 in nsBlockFrame::ReflowInlineFrames (this=0xa655740, aState=@0xbff861a0, aLine={mCurrent = 0xa6ac724, mListLink = 0xa655780}, aKeepReflowGoing=0xbff860bc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:3189
#54 0x01b33eb9 in nsBlockFrame::ReflowLine (this=0xa655740, aState=@0xbff861a0, aLine={mCurrent = 0xb33be88, mListLink = 0xa655780}, aKeepReflowGoing=0xbff860bc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2222
#55 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0xa655740, aState=@0xbff861a0) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#56 0x01b365e3 in nsBlockFrame::Reflow (this=0xa655740, aPresContext=0xa434ed0, aMetrics=@0xbff8682c, aReflowState=@0xbff8673c, aStatus=@0xbff868bc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#57 0x01b3a6d8 in nsBlockReflowContext::ReflowBlock (this=0xbff867e8, aSpace=@0xbff86888, aApplyTopMargin=0, aPrevMargin=@0xbff86ce0, aClearance=0, aIsAdjacentWithTop=1, aComputedOffsets=@0xbff86878, aFrameRS=@0xbff8673c, aFrameReflowStatus=@0xbff868bc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowContext.cpp:370
#58 0x01b331c2 in nsBlockFrame::ReflowBlockFrame (this=0xa6139a0, aState=@0xbff86c60, aLine={mCurrent = 0xa6ac74c, mListLink = 0xa6139e0}, aKeepReflowGoing=0xbff86b7c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2926
#59 0x01b33d22 in nsBlockFrame::ReflowLine (this=0xa6139a0, aState=@0xbff86c60, aLine={mCurrent = 0xb33be88, mListLink = 0xa6139e0}, aKeepReflowGoing=0xbff86b7c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2169
#60 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0xa6139a0, aState=@0xbff86c60) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#61 0x01b365e3 in nsBlockFrame::Reflow (this=0xa6139a0, aPresContext=0xa434ed0, aMetrics=@0xbff872ec, aReflowState=@0xbff871fc, aStatus=@0xbff8737c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#62 0x01b3a6d8 in nsBlockReflowContext::ReflowBlock (this=0xbff872a8, aSpace=@0xbff87348, aApplyTopMargin=1, aPrevMargin=@0xbff877a0, aClearance=0, aIsAdjacentWithTop=0, aComputedOffsets=@0xbff87338, aFrameRS=@0xbff871fc, aFrameReflowStatus=@0xbff8737c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowContext.cpp:370
#63 0x01b331c2 in nsBlockFrame::ReflowBlockFrame (this=0xa3f533c, aState=@0xbff87720, aLine={mCurrent = 0xa6555c4, mListLink = 0xa3f537c}, aKeepReflowGoing=0xbff8763c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2926
#64 0x01b33d22 in nsBlockFrame::ReflowLine (this=0xa3f533c, aState=@0xbff87720, aLine={mCurrent = 0xb33be88, mListLink = 0xa3f537c}, aKeepReflowGoing=0xbff8763c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2169
#65 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0xa3f533c, aState=@0xbff87720) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#66 0x01b365e3 in nsBlockFrame::Reflow (this=0xa3f533c, aPresContext=0xa434ed0, aMetrics=@0xbff87dac, aReflowState=@0xbff87cbc, aStatus=@0xbff87e3c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#67 0x01b3a6d8 in nsBlockReflowContext::ReflowBlock (this=0xbff87d68, aSpace=@0xbff87e08, aApplyTopMargin=1, aPrevMargin=@0xbff88260, aClearance=0, aIsAdjacentWithTop=1, aComputedOffsets=@0xbff87df8, aFrameRS=@0xbff87cbc, aFrameReflowStatus=@0xbff87e3c) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockReflowContext.cpp:370
#68 0x01b331c2 in nsBlockFrame::ReflowBlockFrame (this=0xa3f51b8, aState=@0xbff881e0, aLine={mCurrent = 0xa3e713c, mListLink = 0xa3f51f8}, aKeepReflowGoing=0xbff880fc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2926
#69 0x01b33d22 in nsBlockFrame::ReflowLine (this=0xa3f51b8, aState=@0xbff881e0, aLine={mCurrent = 0xb33be88, mListLink = 0xa3f51f8}, aKeepReflowGoing=0xbff880fc) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:2169
#70 0x01b3516b in nsBlockFrame::ReflowDirtyLines (this=0xa3f51b8, aState=@0xbff881e0) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:1829
#71 0x01b365e3 in nsBlockFrame::Reflow (this=0xa3f51b8, aPresContext=0xa434ed0, aMetrics=@0xbff886cc, aReflowState=@0xbff88620, aStatus=@0xbff88890) at /home/igor/m/trunk/mozilla/layout/generic/nsBlockFrame.cpp:924
#72 0x01b4475e in nsContainerFrame::ReflowChild (this=0xa442e08, aKidFrame=0xa3f51b8, aPresContext=0xa434ed0, aDesiredSize=@0xbff886cc, aReflowState=@0xbff88620, aX=0, aY=0, aFlags=<value optimized out>, aStatus=@0xbff88890, aTracker=0x0) at /home/igor/m/trunk/mozilla/layout/generic/nsContainerFrame.cpp:715
#73 0x01b6dbd6 in CanvasFrame::Reflow (this=0xa442e08, aPresContext=0xa434ed0, aDesiredSize=@0xbff8892c, aReflowState=@0xbff887dc, aStatus=@0xbff88890) at /home/igor/m/trunk/mozilla/layout/generic/nsHTMLFrame.cpp:577
#74 0x01b4475e in nsContainerFrame::ReflowChild (this=0xa442f4c, aKidFrame=0xa442e08, aPresContext=0xa434ed0, aDesiredSize=@0xbff8892c, aReflowState=@0xbff887dc, aX=0, aY=0, aFlags=<value optimized out>, aStatus=@0xbff88890, aTracker=0x0) at /home/igor/m/trunk/mozilla/layout/generic/nsContainerFrame.cpp:715
#75 0x01b68dec in nsHTMLScrollFrame::ReflowScrolledFrame (this=0xa442f4c, aState=@0xbff889e8, aAssumeHScroll=0, aAssumeVScroll=1, aMetrics=0xbff8892c, aFirstPass=1) at /home/igor/m/trunk/mozilla/layout/generic/nsGfxScrollFrame.cpp:456
#76 0x01b68ef2 in nsHTMLScrollFrame::ReflowContents (this=0xa442f4c, aState=0xbff889e8, aDesiredSize=@0xbff88cc0) at /home/igor/m/trunk/mozilla/layout/generic/nsGfxScrollFrame.cpp:538
#77 0x01b694df in nsHTMLScrollFrame::Reflow (this=0xa442f4c, aPresContext=0xa434ed0, aDesiredSize=@0xbff88cc0, aReflowState=@0xbff88b68, aStatus=@0xbff88e70) at /home/igor/m/trunk/mozilla/layout/generic/nsGfxScrollFrame.cpp:749
#78 0x01b4475e in nsContainerFrame::ReflowChild (this=0xa442c10, aKidFrame=0xa442f4c, aPresContext=0xa434ed0, aDesiredSize=@0xbff88cc0, aReflowState=@0xbff88b68, aX=0, aY=0, aFlags=<value optimized out>, aStatus=@0xbff88e70, aTracker=0x0) at /home/igor/m/trunk/mozilla/layout/generic/nsContainerFrame.cpp:715
#79 0x01bc41c5 in ViewportFrame::Reflow (this=0xa442c10, aPresContext=0xa434ed0, aDesiredSize=@0xbff88e40, aReflowState=@0xbff88d94, aStatus=@0xbff88e70) at /home/igor/m/trunk/mozilla/layout/generic/nsViewportFrame.cpp:286
#80 0x01b0c46a in PresShell::DoReflow (this=0xa437228, target=0xa442c10) at /home/igor/m/trunk/mozilla/layout/base/nsPresShell.cpp:6085
#81 0x01b17d1b in PresShell::ProcessReflowCommands (this=0xa437228, aInterruptible=1) at /home/igor/m/trunk/mozilla/layout/base/nsPresShell.cpp:6198
#82 0x01b17f72 in PresShell::WillPaint (this=0xa437228) at /home/igor/m/trunk/mozilla/layout/base/nsPresShell.cpp:5820
#83 0x01efc8c8 in nsViewManager::FlushPendingInvalidates (this=0xa4356b8) at /home/igor/m/trunk/mozilla/view/src/nsViewManager.cpp:2124
#84 0x01efca64 in nsViewManager::EnableRefresh (this=0xa4356b8, aUpdateFlags=0) at /home/igor/m/trunk/mozilla/view/src/nsViewManager.cpp:1838
#85 0x01ef982c in nsViewManager::EndUpdateViewBatch (this=0xa4356b8, aUpdateFlags=0) at /home/igor/m/trunk/mozilla/view/src/nsViewManager.cpp:1883
#86 0x01abea21 in nsCSSFrameConstructor::RestyleEvent::Run (this=0xb3433f8) at /home/igor/m/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp:13036
#87 0x004869eb in nsThread::ProcessNextEvent (this=0x97aa2c0, mayWait=1, result=0xbff89090) at /home/igor/m/trunk/mozilla/xpcom/threads/nsThread.cpp:490
#88 0x00423de1 in NS_ProcessNextEvent_P (thread=0xbff7e09c, mayWait=1) at nsThreadUtils.cpp:227
#89 0x03735049 in nsBaseAppShell::Run (this=0x98870e8) at /home/igor/m/trunk/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
#90 0x0797b74f in nsAppStartup::Run (this=0x98b6768) at /home/igor/m/trunk/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170
#91 0x0015aac1 in XRE_main (argc=3, argv=0xbff89664, aAppData=0x9765998) at /home/igor/m/trunk/mozilla/toolkit/xre/nsAppRunner.cpp:3057
#92 0x08048d9e in main (argc=3, argv=0x18b8f8) at /home/igor/m/trunk/mozilla/browser/app/nsBrowserApp.cpp:153


At the crash line:

    PRInt32 currentRunLength = mSkipChars->mList[mListPrefixLength];

mListPrefixLength is 2949242. Accessing mSkipChars->mList[mListPrefixLength - 100000] works.

Comment 1

[Adam Guthrie]

There are lots of bugs on this crash. I think roc said he's going to post a fix over in bug 385270.

Comment 2

[Igor Bukanov]

(In reply to comment #1)
> There are lots of bugs on this crash. I think roc said he's going to post a fix
> over in bug 385270.

I though initially this was already reported. But I could not find a stack top with those 2 functions, SetOffsets and AdvanceOriginal, in the database so I decided to report it here.

Comment 3

[Jean-Marc Desperrier]

No crash with 2007081705, so apparently solved by bug 385270

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

ok