Closed
Bug 404204
Opened 18 years ago
Closed 18 years ago
"ASSERTION: lost track of line breaks somehow" with RLE, small-caps
Categories
(Core :: Layout: Text and Fonts, defect, P4)
Core
Layout: Text and Fonts
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: smontagu)
References
Details
(Keywords: assertion, testcase, Whiteboard: [sg:low] OOB memory read, post 1.8-branch?)
Attachments
(2 files)
|
89 bytes,
text/html
|
Details | |
|
5.74 KB,
patch
|
roc
:
review+
roc
:
superreview+
|
Details | Diff | Splinter Review |
Loading the testcase triggers:
###!!! ASSERTION: lost track of line breaks somehow: 'nextLineBreak == aTextRun->mLineBreaks.Length()', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextRunTransformations.cpp, line 380
These could become array bounds overflows (reads, probably, but still). Simon, can you take this?
Flags: blocking1.9?
Flags: blocking1.9? → blocking1.9+
Priority: -- → P4
|
Reporter | |
Updated•18 years ago
|
Whiteboard: [sg:low] OOB memory read
|
Assignee | |
Updated•18 years ago
|
Assignee: nobody → smontagu
|
|
Assignee | |
Comment 2•18 years ago
|
||
This is similar to bug 386807 and even more to bug 385414. I believe it's caused by IsDiscardable() in nsTextFrameUtils.cpp stripping the bidi control character, rather than by the bidi resolver (which doesn't change the frame tree at all in this case).
On entering nsFontVariantTextRunFactory::RebuildTextRun, aTextRun->mLineBreaks has 3 entries: 0, 0 and 1.
|
|
Assignee | |
Comment 3•18 years ago
|
||
Attachment #290141 -
Flags: superreview?(roc)
Attachment #290141 -
Flags: review?(roc)
|
|
Assignee | |
Updated•18 years ago
|
Comment on attachment 290141 [details] [diff] [review]
patch
+DIRS += reftests
I'm guessing this should not be here.
Attachment #290141 -
Flags: superreview?(roc)
Attachment #290141 -
Flags: superreview+
Attachment #290141 -
Flags: review?(roc)
Attachment #290141 -
Flags: review+
|
|
Assignee | |
Comment 5•18 years ago
|
||
Checked in (without the irrelevant makefile change)
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
|
|
Assignee | |
Updated•18 years ago
|
Flags: in-testsuite?
|
|
Reporter | |
Comment 6•18 years ago
|
||
Testcase checked in as a crashtest.
|
|
Reporter | |
Updated•18 years ago
|
Flags: in-testsuite? → in-testsuite+
|
||
Comment 7•18 years ago
|
||
I'm not seeing the assertion on the 1.8 branch, assuming this is related to post-1.8 work since I see Thebes as part of the patch.
Flags: wanted1.8.1.x-
Whiteboard: [sg:low] OOB memory read → [sg:low] OOB memory read, post 1.8-branch?
You need to log in
before you can comment on or make changes to this bug.
Description
•