Closed Bug 419095 Opened 16 years ago Closed 16 years ago

"ASSERTION: Couldn't find glyph for trailing marker" and crash [@ SetGlyphsForCharacterGroup]

Categories

(Core :: Graphics, defect, P2)

Product:
Core
Component:
Graphics
Platform:
x86
macOS
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: jruderman, Assigned: roc)

References

Details

(Keywords: assertion, crash, testcase, Whiteboard: [sg:critical])

Crash Data

Attachments

(2 files)

testcase (crashes Firefox when loaded)
557 bytes, text/html
Details
stack trace
8.84 KB, text/plain
Details 
Loading the testcase triggers:

###!!! ASSERTION: Couldn't find glyph for trailing marker: 'glyphRecords[0].originalOffset == aSegmentLength*2', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxAtsuiFonts.cpp, line 1046

###!!! ASSERTION: Index out of range: 'aIndex < mCharacterCount', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxFont.cpp, line 1736

###!!! ASSERTION: invalid array index: 'i < Length()', file ../../../dist/include/xpcom/nsTArray.h, line 317

Crash [@ SetGlyphsForCharacterGroup] calling a random address.
Flags: blocking1.9?

    
    

    
  

      
      
      
      

        Attached file
          
        stack trace
        — 
      

    


  

    
    

    
  
Fallout from Bug 418754?

    
  
Whiteboard: [sg:critical]
Assignee: nobody → roc
Flags: blocking1.9? → blocking1.9+
Priority: -- → P2

    
  
Flags: tracking1.9+ → blocking1.9+

    
    

    
  
Fixed by patch in bug 416637 awaiting review from Vlad :-)
Whiteboard: [sg:critical] → [sg:critical][depends on 416637]

    
    

    
  
Fixed by landing of bug 416637.
Status: NEW → RESOLVED
Closed: 16 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Whiteboard: [sg:critical][depends on 416637] → [sg:critical]

    
    

    
  
verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b5pre) Gecko/2008031704 Minefield/3.0b5pre. No crash using the testcase.
Status: RESOLVED → VERIFIED
Crash Signature: [@ SetGlyphsForCharacterGroup]
Group: core-security

          You need to log in
          before you can comment on or make changes to this bug.