490777 - ASSERTION: character/glyph clump contains no glyphs!

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Jesse Ruderman]

Attachment: testcase

I'm hitting this a lot.  Regression from bug 481948?

Comment 1

[Jesse Ruderman]

###!!! ASSERTION: character/glyph clump contains no glyphs!: 'glyphStart < glyphEnd', file /Users/jruderman/central/gfx/thebes/src/gfxAtsuiFonts.cpp, line 1151

###!!! ASSERTION: character/glyph contains no characters!: 'charStart != charEnd', file /Users/jruderman/central/gfx/thebes/src/gfxAtsuiFonts.cpp, line 1152

###!!! ASSERTION: aPos out of range: '0 <= aPos && aPos < mCharacterCount', file ../../../dist/include/thebes/gfxFont.h, line 857

###!!! ASSERTION: Index out of range: 'aIndex < mCharacterCount', file /Users/jruderman/central/gfx/thebes/src/gfxFont.cpp, line 2295

firefox-bin(25991,0xa04ca720) malloc: *** error for object 0x77180000: pointer being freed was not allocated

many of
###!!! ASSERTION: aPos out of range: '0 <= aPos && aPos < mCharacterCount', file ../../../dist/include/thebes/gfxFont.h, line 857

crash [@ gfxTextRun::CompressedGlyph::IsClusterStart] touching 0x1ee00000

Comment 2

[Jesse Ruderman]

I see this bug on my bottom mini, but not on my macbook pro.  Odd, since they're both running Leopard.

Comment 3

[Jonathan Kew [:jfkthame]]

Yes, this will surely be a result of bug 481948.

(In reply to comment #2)
> I see this bug on my bottom mini, but not on my macbook pro.  Odd, since
> they're both running Leopard.

Are you running the same binary on both, or building separately on each? I notice the problem is in the (rewrite of the) ATSUI text path, so I'm guessing your MBPro is using CoreText instead. So either a build difference (10.4u vs 10.5 SDK, which determines whether the CoreText code is built), or a profile difference.

Comment 4

[Jesse Ruderman]

Building separately.  It will be a few weeks before I can see which SDK each computer uses.

Comment 5

[Jonathan Kew [:jfkthame]]

Confirmed that I get this failure with ATSUI and not with CoreText (with the same build, 10.5 SDK, using the gfx.force_atsui_text pref to control which path is used).

Comment 6

[Jonathan Kew [:jfkthame]]

Attachment: fix handling of unpaired low surrogate in RTL text

The particular case that triggered the failure is an isolated low surrogate in a right-to-left text run. The clustering code has a special case for low surrogates in RTL text in order to improve cursor/selection behavior (to associate them with the proper high surrogate), but we shouldn't do this if the low surrogate was unpaired.

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 375261 [details] [diff] [review]
fix handling of unpaired low surrogate in RTL text

add a line break so the line isn't too long

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Should add the test as a crashtest too.

Comment 9

[Jonathan Kew [:jfkthame]]

Attachment: broken the long line, added crashtest [Checkin: Comment 10]

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

http://hg.mozilla.org/mozilla-central/rev/24793a90135d

Comment 11

[Jonathan Kew [:jfkthame]]

Attachment: patch for 1.9.1, to be landed along with bug 481948

Code patch is exactly the same for trunk and 1.9.1 (once 481948 is applied there), but in order to land cleanly the crashtest list is updated. This should land on branch at the same time as bug 481948, otherwise we will have a regression there.

Comment 12

[Jonathan Kew [:jfkthame]]

Attachment: patch for 1.9.1, corrected [Checkin: Comment 15]

Previous version of the 1.9.1 patch was incomplete (failed to add the test file). Sorry about the bug-spam. :(

Comment 13

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 376486 [details] [diff] [review]
patch for 1.9.1, corrected
[Checkin: Comment 15]

a191=beltzner

Comment 14

[Jonathan Kew [:jfkthame]]

NB: for 1.9.1, this should land on top of the patch for bug 481948, and be
pushed together.

Comment 15

[Serge Gautherie (:sgautherie)]

Comment on attachment 376486 [details] [diff] [review]
patch for 1.9.1, corrected
[Checkin: Comment 15]


http://hg.mozilla.org/releases/mozilla-1.9.1/rev/2a4c9e79d7b8