421393 - Crashes [@ gfxTextRun::SetMissingGlyph] with RLO and other characters

Status: RESOLVED WORKSFORME

(Core :: Layout: Text and Fonts, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase triggers:

###!!! ASSERTION: Couldn't find glyph for trailing marker: 'glyphRecords[0].originalOffset == aSegmentLength*2', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxAtsuiFonts.cpp, line 1046

###!!! ASSERTION: Index out of range: 'aIndex < mCharacterCount', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxFont.cpp, line 1736

firefox-bin(738,0xa000d000) malloc: ***  Deallocation of a pointer not malloced: 0x77180000; This could be a double free(), or free() called with the middle of an allocated block; Try setting environment variable MallocHelp to see tools to help debug

###!!! ASSERTION: invalid array index: 'i < Length()', file ../../../dist/include/xpcom/nsTArray.h, line 317


If you have MallocScribble and MallocPreScribble enabled, it will then crash [@ gfxTextRun::SetMissingGlyph] trying to access memory at 0xaaaaaaaa.  Without scribbling enabled, it may or may not crash.

Comment 1

[Jesse Ruderman]

WFM using Mac trunk debug (no assertions, no crash) (tested both with and without Malloc*Scribble).

Comment 2

[Jesse Ruderman]

Crashtest checked in.