398649 - when opening a text file that has many null bytes, browser hangs

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect, P2)

Description

[Ryuichi KUBUKI]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a9pre) Gecko/2007100416 Minefield/3.0a9pre ID:2007100416

1. Create a text file that has a text content at its head, and null '\0' bytes in the middle, and a text contents at the end.
2. Put it on a web server.
3. Open Places Organizer and add a new item that has the URL to the file in the step 2.
4. Open it from Places Organizer by clicking it.

Result: FF hangs.


It doesn't freeze if you open it directly by typing the URL in the location bar, it only happens via Places.

Comment 1

[Ryuichi KUBUKI]

Attachment: testcase

Comment 2

[(not reading, please use [e-mail] instead)]

actually, the browser will hang if you try to load that test case.

you'll run into it with places because we attempt to load the page (to get the microsummary)

debugging, we're stuck in this while loop in
gfxWindowsFontGroup::InitTextRunUniscribe()

            while (FAILED(item->Shape())) {
                PR_LOG(gFontLog, PR_LOG_DEBUG, ("shaping failed"));
                // we know we have the glyphs to display this font already
                // so Uniscribe just doesn't know how to shape the script.
                // Render the glyphs without shaping.
                item->DisableShaping();
            }

here's a stack:

>	thebes.dll!UniscribeItem::GenerateAlternativeString()  Line 1449 + 0x17 bytes	C++
 	thebes.dll!UniscribeItem::DisableShaping()  Line 981	C++
 	thebes.dll!gfxWindowsFontGroup::InitTextRunUniscribe(gfxContext * aContext=0x066ea450, gfxTextRun * aRun=0x067ecae0, const unsigned short * aString=0x06737fe0, unsigned int aLength=47501)  Line 1600	C++
 	thebes.dll!gfxWindowsFontGroup::InitTextRunGDI(gfxContext * aContext=0x066ea450, gfxTextRun * aRun=0x067ecae0, const unsigned short * aString=0x06737fe0, unsigned int aLength=47501)  Line 747	C++
 	thebes.dll!gfxWindowsFontGroup::MakeTextRun(const unsigned short * aString=0x06737fe0, unsigned int aLength=47501, const gfxTextRunFactory::Parameters * aParams=0x0012a19c, unsigned int aFlags=16779265)  Line 572	C++
 	thebes.dll!TextRunWordCache::MakeTextRun(const unsigned short * aText=0x0676be10, unsigned int aLength=65383, gfxFontGroup * aFontGroup=0x06600f10, const gfxTextRunFactory::Parameters * aParams=0x0012b5e4, unsigned int aFlags=16779264)  Line 434 + 0x31 bytes	C++
 	thebes.dll!gfxTextRunWordCache::MakeTextRun(const unsigned short * aText=0x0676be10, unsigned int aLength=65383, gfxFontGroup * aFontGroup=0x06600f10, const gfxTextRunFactory::Parameters * aParams=0x0012b5e4, unsigned int aFlags=16779264)  Line 659	C++
 	gklayout.dll!MakeTextRun(const unsigned short * aText=0x0676be10, unsigned int aLength=65383, gfxFontGroup * aFontGroup=0x06600f10, const gfxTextRunFactory::Parameters * aParams=0x0012b5e4, unsigned int aFlags=16779264)  Line 387 + 0x1a bytes	C++
 	gklayout.dll!BuildTextRunsScanner::BuildTextRunForFrames(void * aTextBuffer=0x0678bcde)  Line 1513 + 0x1f bytes	C++
 	gklayout.dll!BuildTextRunsScanner::FlushFrames(int aFlushLineBreaks=1)  Line 1008	C++
 	gklayout.dll!BuildTextRuns(nsIRenderingContext * aRC=0x06737e70, nsTextFrame * aForFrame=0x066e33e4, nsIFrame * aLineContainer=0x0672a558, const nsLineList_iterator * aForFrameLine=0x0012d094)  Line 949	C++
 	gklayout.dll!nsTextFrame::EnsureTextRun(nsIRenderingContext * aRC=0x06737e70, nsIFrame * aLineContainer=0x0672a558, const nsLineList_iterator * aLine=0x0012d094, unsigned int * aFlowEndInTextRun=0x0012cc58)  Line 1717 + 0x1a bytes	C++
 	gklayout.dll!nsTextFrame::Reflow(nsPresContext * aPresContext=0x066de4c0, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=107885540)  Line 5090	C++
 	gklayout.dll!nsLineLayout::ReflowFrame(nsIFrame * aFrame=0x066e33e4, unsigned int & aReflowStatus=107885540, nsHTMLReflowMetrics * aMetrics=0x00000000, int & aPushedFrame=0)  Line 882 + 0x2d bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & aState={...}, nsLineLayout & aLineLayout={...}, nsLineList_iterator aLine={...}, nsIFrame * aFrame=0x066e33e4, LineReflowStatus * aLineReflowStatus=0x0012cfd8)  Line 3555 + 0x16 bytes	C++
 	gklayout.dll!nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & aState={...}, nsLineLayout & aLineLayout={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012d390, LineReflowStatus * aLineReflowStatus=0x0012d10c, int aAllowPullUp=1)  Line 3375 + 0x20 bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012d390)  Line 3219 + 0x2a bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012d390)  Line 2252 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & aState={...})  Line 1837 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::Reflow(nsPresContext * aPresContext=0x066de4c0, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 923 + 0xf bytes	C++
 	gklayout.dll!nsBlockReflowContext::ReflowBlock(const nsRect & aSpace={...}, int aApplyTopMargin=0, nsCollapsingMargin & aPrevMargin={...}, int aClearance=0, int aIsAdjacentWithTop=1, nsMargin & aComputedOffsets={...}, nsLineBox * aLine=0x0672a9a0, nsHTMLReflowState & aFrameRS={...}, unsigned int & aFrameReflowStatus=0, nsBlockReflowState & aState={...})  Line 339 + 0x2c bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012df04)  Line 2956 + 0x4f bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012df04)  Line 2199 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & aState={...})  Line 1837 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::Reflow(nsPresContext * aPresContext=0x066de4c0, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 923 + 0xf bytes	C++
 	gklayout.dll!nsBlockReflowContext::ReflowBlock(const nsRect & aSpace={...}, int aApplyTopMargin=1, nsCollapsingMargin & aPrevMargin={...}, int aClearance=0, int aIsAdjacentWithTop=1, nsMargin & aComputedOffsets={...}, nsLineBox * aLine=0x0672a4a8, nsHTMLReflowState & aFrameRS={...}, unsigned int & aFrameReflowStatus=0, nsBlockReflowState & aState={...})  Line 339 + 0x2c bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012ea78)  Line 2956 + 0x4f bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012ea78)  Line 2199 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & aState={...})  Line 1837 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::Reflow(nsPresContext * aPresContext=0x066de4c0, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 923 + 0xf bytes	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x0672a2b8, nsPresContext * aPresContext=0x066de4c0, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int aY=0, unsigned int aFlags=0, unsigned int & aStatus=0, nsOverflowContinuationTracker * aTracker=0x00000000)  Line 715 + 0x21 bytes	C++
 	gklayout.dll!CanvasFrame::Reflow(nsPresContext * aPresContext=0x066de4c0, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 582	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x066e30f8, nsPresContext * aPresContext=0x066de4c0, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int aY=0, unsigned int aFlags=3, unsigned int & aStatus=0, nsOverflowContinuationTracker * aTracker=0x00000000)  Line 715 + 0x21 bytes	C++
 	gklayout.dll!nsHTMLScrollFrame::ReflowScrolledFrame(const ScrollReflowState & aState={...}, int aAssumeHScroll=0, int aAssumeVScroll=1, nsHTMLReflowMetrics * aMetrics=0x0012f340, int aFirstPass=1)  Line 450 + 0x30 bytes	C++
 	gklayout.dll!nsHTMLScrollFrame::ReflowContents(ScrollReflowState * aState=0x0012f3e0, const nsHTMLReflowMetrics & aDesiredSize={...})  Line 532 + 0x1b bytes	C++
 	gklayout.dll!nsHTMLScrollFrame::Reflow(nsPresContext * aPresContext=0x066de4c0, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 743 + 0x13 bytes	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x066e323c, nsPresContext * aPresContext=0x066de4c0, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int aY=0, unsigned int aFlags=0, unsigned int & aStatus=0, nsOverflowContinuationTracker * aTracker=0x00000000)  Line 715 + 0x21 bytes	C++
 	gklayout.dll!ViewportFrame::Reflow(nsPresContext * aPresContext=0x066de4c0, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 286 + 0x2d bytes	C++
 	gklayout.dll!PresShell::DoReflow(nsIFrame * target=0x066e3064)  Line 6135	C++
 	gklayout.dll!PresShell::ProcessReflowCommands(int aInterruptible=1)  Line 6235	C++
 	gklayout.dll!PresShell::DoFlushPendingNotifications(mozFlushType aType=Flush_Layout, int aInterruptibleReflow=1)  Line 4472	C++
 	gklayout.dll!PresShell::ReflowEvent::Run()  Line 5999	C++
 	xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012f990)  Line 491	C++
 	xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x00cc1148, int mayWait=1)  Line 227 + 0x16 bytes	C++
 	gkwidget.dll!nsBaseAppShell::Run()  Line 154 + 0xc bytes	C++
 	tkitcmps.dll!nsAppStartup::Run()  Line 170 + 0x1c bytes	C++
 	xul.dll!XRE_main(int argc=3, char * * argv=0x00bd9a10, const nsXREAppData * aAppData=0x00bdc1c8)  Line 3123 + 0x25 bytes	C++
 	firefox.exe!main(int argc=3, char * * argv=0x00bd9a10)  Line 153 + 0x12 bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 586 + 0x19 bytes	C
 	firefox.exe!mainCRTStartup()  Line 403	C
 	kernel32.dll!7c816fd7() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]	
 	xpcom_core.dll!nsCString::RFind(const char * aString=0x006b006f, int aIgnoreCase=7209061, int aOffset=2228285, int aCount=3473462)  Line 89 + 0x1a bytes	C++
 	js3250.dll!SaveScriptFilename(JSRuntime * rt=0x0032002e, const char * filename=0x00300036, unsigned long flags=3014704)  Line 1114 + 0x3 bytes	C
 	xpcom_core.dll!nsExceptionManager::Release()  Line 97 + 0x9e bytes	C++
 	xpcom_core.dll!nsExceptionManager::Release()  Line 97 + 0x9e bytes	C++
 	js3250.dll!SaveScriptFilename(JSRuntime * rt=0x006b006f, const char * filename=0x006e0065, unsigned long flags=2228285)  Line 1114 + 0x3 bytes	C
 	js3250.dll!SaveScriptFilename(JSRuntime * rt=0x006b006f, const char * filename=0x006e0065, unsigned long flags=2228285)  Line 1114 + 0x3 bytes	C
 	js3250.dll!SaveScriptFilename(JSRuntime * rt=0x00350036, const char * filename=0x00350039, unsigned long flags=3539042)  Line 1114 + 0x3 bytes	C

Comment 3

[Stuart Parmenter]

i have a patch for that function to make it so you don't get stuck...  i'll dig it up tomorrow

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Chris also has a patch that should fix this.

Comment 5

[Chris Pearce [:cpearce (Not reading bugmail)]]

Yeah, patch 285788 from bug 394751 should fix this.

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

Looks like someone's already checked in a change to gfxWindowsFontGroup::InitTextRunUniscribe() that prevents the infinite loop/hang, my patch should fix the underlying issue which is that there's a line too long for ::ScriptShape() to handle.

Comment 7

[Chris Pearce [:cpearce (Not reading bugmail)]]

To clarify:

* The testcase does not hang for me, because someone checked in a change to the loop in gfxWindowsFontGroup::InitTextRunUniscribe().
* I think the underlying problem which caused the hang was a line too long for ::ScriptShape() to handle, as in bug 394751. This bug and that bug have the same underlying problem, so the fix for that bug will fix this bug properly.