399365 - "ASSERTION: Invalid offset" and "ASSERTION: Text run does not map enough text for our reflow" with rtl, pre

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92

###!!! ASSERTION: Text run does not map enough text for our reflow: 'gfxSkipCharsIterator(iter).ConvertOriginalToSkipped(offset + length) <= mTextRun->GetLength()', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp, line 5135

###!!! ASSERTION: unconstrained height on totally empty line: 'NS_UNCONSTRAINEDSIZE != aState.mAvailSpaceRect.height', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockFrame.cpp, line 3462

###!!! ASSERTION: redo line on totally empty line with non-empty band...: 'aState.IsImpactedByFloat()', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockFrame.cpp, line 3466

More complicated testcases can trigger other assertions and/or cause a hang.

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Simon, this looks like something you could fix. We're reflowing a frame tree that looks like this:

          Block(body)(1)@0x247fae4 {480,480,62820,6912} [state=00001001] sc=0x247f8ac(i=5,b=0)<
            line 0x24801d0: count=1 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x4000] {0,0,0,0} <
              Text(0)@0x247ffd0[0,1,T]  next=0x247c220 {0,0,0,0} [state=00220403] [content=0x3e214510] sc=0x247fa44 pst=:-moz-non-element<
                "y"
              >
            >
            line 0x247fb78: count=1 state=inline,dirty,prevmarginclean,not impacted,not wrapped,before:nobr,after:linebr[0x5101] {62820,0,0,1728} <
              Text(1)@0x247c220[0,4,F]  next=0x247fd74 next-continuation=0x247fd74 {62820,144,0,1440} [state=00220000] [content=0x3e222080] sc=0x247fa44 pst=:-moz-non-element<
                "\ne\n0"
              >
            >
            line 0x247fe50: count=1 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:linebr[0x5100] {62181,1728,639,1728} ca={0,1728,62820,1728} <
              Text(1)@0x247fd74[4,2,T]  next=0x247feac prev-continuation=0x247c220 next-continuation=0x247feac {62181,1872,639,1440} [state=00620000] [content=0x3e222080] sc=0x247fa44 pst=:-moz-non-element<
                "\n "
              >
            >
            line 0x247fef0: count=2 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:linebr[0x9100] {62100,3456,720,1728} ca={0,3456,62820,1728} <
              Text(1)@0x247feac[6,-2,F]  next=0x247fdb8 prev-continuation=0x247fd74 next-continuation=0x247fdb8 {62100,3600,720,1440} [state=00620004] [content=0x3e222080] sc=0x247fa44 pst=:-moz-non-element<
                ""
              >
              Text(1)@0x247fdb8[4,1,F]  next=0x247ff18 prev-continuation=0x247feac next-continuation=0x247ff18 {62100,3600,0,1440} [state=00020004] [content=0x3e222080] sc=0x247fa44 pst=:-moz-non-element<
                "\n"
              >
            >
            line 0x247ff5c: count=1 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x4100] {62460,5184,360,1728} ca={0,5184,62820,1728} <
              Text(1)@0x247ff18[5,1,T]  prev-continuation=0x247fdb8 {62460,5328,360,1440} [state=00620004] [content=0x3e222080] sc=0x247fa44 pst=:-moz-non-element<
                " "
              >
            >

The real problem is that the start-offset decreases along the continuation chain (from 6 to 4), that should not happen. I assume it's something to do with bidi resolution.

Comment 2

[Simon Montagu :smontagu]

Fixed by bug 397961

Comment 3

[Jesse Ruderman]

Crashtest checked in.

Comment 4

[(no longer active)]

Mass-assigning the new rtl keyword to RTL-related (see bug 349193).