576435 - ASSERTION: How can this ever happen?: '*aUnconstrainedSize <= scriptLevelSize'

Status: RESOLVED FIXED

(Core :: MathML, defect)

Description

[Jesse Ruderman]

On Windows only, layout/style/crashtests/413274-1.xhtml triggers:

###!!! ASSERTION: How can this ever happen?: '*aUnconstrainedSize <= scriptLevelSize', file layout/style/nsRuleNode.cpp, line 2650

###!!! ASSERTION: scriptminsize should never be making things bigger: 'aFont->mScriptUnconstrainedSize <= aFont->mSize', file layout/style/nsRuleNode.cpp, line 3087

Comment 2

[(Away)]

From the duplicate:

What this boils down to is that on 32-bit Windows, NSToCoordRound(nscoord_MAX) is negative, despite the assurances in NS_lroundup30: http://hg.mozilla.org/mozilla-central/annotate/c482c28b35b6/xpcom/ds/nsMathUtils.h#l38

Comment 3

[(Away)]

Attachment: Use NSToCoordRoundWithClamp instead of clamping by hand

We talked about removing NS_lroundup30 completely, but I'm scared to undo that perf shortcut, since the regular MSVC code for it is still yucky these days.

How about this instead?

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 8444326 [details] [diff] [review]
Use NSToCoordRoundWithClamp instead of clamping by hand

Review of attachment 8444326 [details] [diff] [review]:
-----------------------------------------------------------------

definitely!

Comment 5

[(Away)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3c1828d5bfe5
https://tbpl.mozilla.org/?tree=Try&rev=9e29cf2cda3e

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/3c1828d5bfe5