396321 - "ASSERTION: Couldn't find glyph for trailing marker" with <svg:text>, RLE

Status: VERIFIED FIXED

(Core :: Graphics, defect, P1)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers this assertion, at least the first time it's loaded in a session:

###!!! ASSERTION: Couldn't find glyph for trailing marker: 'glyphRecords[numGlyphs - 1].originalOffset == aSegmentLength*2', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxAtsuiFonts.cpp, line 865

With a testcase more complicated than the one I'm attaching, this leads to a crash that looks exploitable.

I'm testing with the patch from bug 395458 comment 3.

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

The text-frame code strips IsDiscardable characters before creating a textrun with them; looks like SVG needs to, too:

http://mxr.mozilla.org/seamonkey/source/layout/generic/nsTextFrameUtils.cpp#73

I suppose I could add these to gfxFontGroup::IsInvalidChar, though, which would fix this. Guess I'll do that.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I need the patch in bug 395458 to land first because it will conflict with this one.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

Just make bidi control characters illegal to be passed to MakeTextRun. gfxTextRunWordCache (which SVG and all other textrun consumers use) will filter them automatically.

Comment 4

[Stuart Parmenter]

Comment on attachment 285958 [details] [diff] [review]
fix

this is fine -- imho unicharutil should live near the bottom of the dependency stack.

that said, nsBidiUtils.h shouldn't include nsCOMPtr.h

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Comment on attachment 285958 [details] [diff] [review]
fix

a=drivers, please land ASAP for M9

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in.

Comment 7

[Carsten Book [:Tomcat]]

verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b3pre) Gecko/2008011009 Firefox/3.0b3pre ID:2008011009 and the testcase from jesse.

-> Verified fixed

Comment 8

[Jesse Ruderman]

This bug doesn't seem to affect the 1.8 branch.

Comment 9

[Jesse Ruderman]

Crashtest checked in.