Crashes [@ gfxTextRun::SetMissingGlyph] with RLO and other characters

RESOLVED WORKSFORME

Status

()

Core
Layout: Text
--
critical
RESOLVED WORKSFORME
11 years ago
7 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, crash, testcase})

Trunk
x86
Mac OS X
assertion, crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical?], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

11 years ago
Created attachment 307823 [details]
testcase (crashes Firefox when loaded)

Loading the testcase triggers:

###!!! ASSERTION: Couldn't find glyph for trailing marker: 'glyphRecords[0].originalOffset == aSegmentLength*2', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxAtsuiFonts.cpp, line 1046

###!!! ASSERTION: Index out of range: 'aIndex < mCharacterCount', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxFont.cpp, line 1736

firefox-bin(738,0xa000d000) malloc: ***  Deallocation of a pointer not malloced: 0x77180000; This could be a double free(), or free() called with the middle of an allocated block; Try setting environment variable MallocHelp to see tools to help debug

###!!! ASSERTION: invalid array index: 'i < Length()', file ../../../dist/include/xpcom/nsTArray.h, line 317


If you have MallocScribble and MallocPreScribble enabled, it will then crash [@ gfxTextRun::SetMissingGlyph] trying to access memory at 0xaaaaaaaa.  Without scribbling enabled, it may or may not crash.
(Reporter)

Updated

11 years ago
Whiteboard: [sg:critical?]
(Reporter)

Comment 1

11 years ago
WFM using Mac trunk debug (no assertions, no crash) (tested both with and without Malloc*Scribble).
Group: security
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → WORKSFORME

Updated

11 years ago
Flags: in-testsuite?
(Reporter)

Comment 2

11 years ago
Crashtest checked in.
Flags: in-testsuite? → in-testsuite+
(Assignee)

Updated

7 years ago
Crash Signature: [@ gfxTextRun::SetMissingGlyph]
You need to log in before you can comment on or make changes to this bug.