595435 - "ASSERTION: Invalid offset" and more with rtl, huge line-height

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file gfx/thebes/gfxSkipChars.cpp, line 92

###!!! ASSERTION: Text run does not map enough text for our reflow: 'gfxSkipCharsIterator(iter).ConvertOriginalToSkipped(offset + length) <= mTextRun->GetLength()', file layout/generic/nsTextFrameThebes.cpp, line 6385

Comment 1

[Jesse Ruderman]

Attachment: stacks and additional assertions

Comment 2

[Simon Montagu :smontagu]

Attachment: Patch

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

-      length = newLineOffset + 1 - offset;
+      length = contentNewLineOffset + 1 - offset;

Why this change?

Comment 4

[Simon Montagu :smontagu]

Attachment: Corrected patch

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 486792 [details] [diff] [review]
Corrected patch

need test too

Comment 6

[Simon Montagu :smontagu]

http://hg.mozilla.org/mozilla-central/rev/06ec9fa89d20 (test)
http://hg.mozilla.org/mozilla-central/rev/1dad59de62c4

Comment 7

[Jesse Ruderman]

The testcase still triggers the same 4 assertions, so the patch didn't fix this bug as described in comment 0.  Furthermore, the crashtest is marked as triggering 4 assertions without a bug number.

If the patch didn't fix this bug, what did it do?

Comment 8

[Simon Montagu :smontagu]

(In reply to comment #7)
> The testcase still triggers the same 4 assertions, so the patch didn't fix this
> bug as described in comment 0. 

That would be because there were strange failures on a couple of tinderboxes (I think as a result of checking in just before the end of DST) and I backed out. Now relanded:

http://hg.mozilla.org/mozilla-central/rev/3e76ac6c6be7
http://hg.mozilla.org/mozilla-central/rev/70657efea2df

> Furthermore, the crashtest is marked as
> triggering 4 assertions without a bug number.

Filed bug 610331 and updated the manifest to refer to it.