495875 - Crash [@ BuildTextRunsScanner::BreakSink::SetBreaks] with -moz-column, pre-wrap, font-size-adjust, multiple text runs

Status: RESOLVED FIXED

(Core :: Layout, defect, P2)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: Flag set that should never be set! (memory safety error?): '!(mTextRun->GetFlags() & (gfxTextRunWordCache::TEXT_UNUSED_FLAGS | nsTextFrameUtils::TEXT_UNUSED_FLAG))', file /Users/jruderman/central/layout/generic/nsTextFrameThebes.cpp, line 766

or

Crash [@ BuildTextRunsScanner::BreakSink::SetBreaks] touching random a memory location.

Comment 1

[Jesse Ruderman]

Still crashes on mozilla-central.

Comment 2

[Simon Montagu :smontagu]

Attachment: Testcase without bidi

I can only reproduce the crash in debug builds. It turns out that it doesn't depend on bidi but rather on having multiple text runs in the same line, as this variation on the testcase shows.

Comment 3

[Simon Montagu :smontagu]

Interestingly, this is debug-only on Linux, but not on OS X.
It's a regression from bug 465928, and I think I have a patch.

Comment 4

[Simon Montagu :smontagu]

Attachment: Patch

This passed unit tests on tryserver.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 405854 [details] [diff] [review]
Patch

Thanks

Comment 6

[Simon Montagu :smontagu]

http://hg.mozilla.org/mozilla-central/rev/28ac205d2563

Comment 7

[Daniel Veditz [:dveditz]]

Does this bug affect 1.9.0?

Comment 8

[Simon Montagu :smontagu]

(In reply to comment #7)
> Does this bug affect 1.9.0?

No, the code that caused the regression was never checked in to 1.9.0, and neither test case crashes there.

Comment 9

[Simon Montagu :smontagu]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/e82b9a962a9f

Comment 10

[Samuel Sidler (old account; do not CC)]

Simon, is this patch ready for 1.9.1? If so (and assuming it applies), please request approval on it. Code freeze for 1.9.1.6 is November 10 at 11:59pm.

Comment 11

[Simon Montagu :smontagu]

Comment on attachment 405854 [details] [diff] [review]
Patch

Requesting approval for 1.9.1.6.

This fixes a regression from bug 465928, which is one of the dependencies of performance bug 430332. I don't see any regression in performance in the test case there with this patch.

Comment 12

[Daniel Veditz [:dveditz]]

Comment on attachment 405854 [details] [diff] [review]
Patch

Approved for 1.9.1.6, a=dveditz for release-drivers

Comment 13

[Simon Montagu :smontagu]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/98a52f52cbe5

Comment 14

[Al Billings [:abillings - ex-MoCo]]

Verified on OS X with attached testcase. Crashes in 1.9.1.5 but not in the nightly 1.9.1.6 build, Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.6pre) Gecko/20091110 Shiretoko/3.5.6pre.