418007 - "ASSERTION: scriptminsize should never be making things bigger" with huge fontsize, td

Status: RESOLVED WORKSFORME

(Core :: MathML, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

WARNING: negative font size: file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxFont.cpp, line 893

###!!! ASSERTION: scriptminsize should never be making things bigger: 'aFont->mScriptUnconstrainedSize <= aFont->mSize', file /Users/jruderman/trunk/mozilla/layout/style/nsRuleNode.cpp, line 2400

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Probably some kind of overflow issue.

Comment 2

[Vlad Sukhoy]

Looks like the overflow happens in nsRuleNode.cpp in CalcLengthWidth, more specifically in:

    case eCSSUnit_Char: {
      return NSToCoordRound(aValue.GetFloatValue() * float(aFontSize));
      // XXX scale against font metrics height instead?
    }

Now, above is not the only call-site of NSToCoordRound in the function. I'm wondering if we should protect all of said sites against overflow or perhaps we should look elsewhere.. Hope this helps.

Comment 3

[Vlad Sukhoy]

Attachment: overflow guard

Guard against overflow at that location.

Comment 4

[Jesse Ruderman]

WFM on trunk.

Comment 5

[Jesse Ruderman]

Crashtest: http://hg.mozilla.org/mozilla-central/rev/f4622261cce8