Last Comment Bug 736227 - "ASSERTION: unexpected state" with MathML, astral font name
: "ASSERTION: unexpected state" with MathML, astral font name
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: MathML (show other bugs)
: Trunk
: x86_64 All
: -- normal (vote)
: mozilla14
Assigned To: Jonathan Kew (:jfkthame)
:
Mentors:
Depends on:
Blocks: 347580 210501
  Show dependency treegraph
 
Reported: 2012-03-15 12:54 PDT by Jesse Ruderman
Modified: 2012-04-09 15:15 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
-


Attachments
testcase (104 bytes, application/xml)
2012-03-15 12:54 PDT, Jesse Ruderman
no flags Details
stack trace (2.34 KB, text/plain)
2012-03-15 12:55 PDT, Jesse Ruderman
no flags Details
stack trace from linux (7.56 KB, text/plain)
2012-03-30 19:02 PDT, Jesse Ruderman
no flags Details
patch, fix surrogate handling during string compare (1.04 KB, patch)
2012-04-04 22:17 PDT, Jonathan Kew (:jfkthame)
smontagu: review+
Details | Diff | Review

Description Jesse Ruderman 2012-03-15 12:54:57 PDT
Created attachment 606329 [details]
testcase

###!!! ASSERTION: unexpected state: 'aRenderingContext.FontMetrics()->Font(). Equals(aFontMetrics->Font())', file layout/mathml/nsMathMLFrame.cpp, line 338
Comment 1 Jesse Ruderman 2012-03-15 12:55:16 PDT
Created attachment 606330 [details]
stack trace
Comment 2 Karl Tomlinson (ni?:karlt) 2012-03-15 14:01:15 PDT
I haven't managed to reproduce on Linux x86_64.

The stack doesn't seem to quite line up with the assertion.  If the stack is off by one frame and one line, then that would locate the GetAxisHeight call here:
http://hg.mozilla.org/mozilla-central/annotate/f6d38b80417c/layout/mathml/nsMathMLmfencedFrame.cpp#l255

Given the rendContext->SetFont(fm) immediately prior, I would expect rendContext->FontMetrics() to return fm.

I don't see any obvious problem with nsFont::Equals.
Comment 3 Jesse Ruderman 2012-03-30 19:00:13 PDT
I can reproduce on Linux x86_64, even with an empty profile.
Comment 4 Jesse Ruderman 2012-03-30 19:02:31 PDT
Created attachment 611107 [details]
stack trace from linux

Is this more helpful?
Comment 5 Karl Tomlinson (ni?:karlt) 2012-04-01 23:24:28 PDT
That trace confirms the GetAxisHeight call in comment 2, thanks.
I can reproduce now.  Seems that this is regression since 7e158ac25de3.
Will narrow down further.
Comment 6 Karl Tomlinson (ni?:karlt) 2012-04-02 00:52:02 PDT
Regression from http://hg.mozilla.org/mozilla-central/rev/edc0871b4e5b
Comment 7 Alex Keybl [:akeybl] 2012-04-04 16:11:00 PDT
Other than this being a regression, what's the justification for tracking this bug? Will this be a common error for MathML users? In what state is the user left when they run into this?
Comment 8 Karl Tomlinson (ni?:karlt) 2012-04-04 16:19:54 PDT
The bug doesn't affect this MathML testcase adversely (from a user perspective).

What the assertion is highlighting is that, for string |a|, a.Equals(a) is false (perhaps only for a certain comparator), which is likely to have wider ranging affects.  Perhaps the problem is only for non-BMP characters, but a problem with surrogates may be a problem with array index counting.
Comment 9 Jonathan Kew (:jfkthame) 2012-04-04 22:17:58 PDT
Created attachment 612457 [details] [diff] [review]
patch, fix surrogate handling during string compare

Argh - silly typo!
Comment 11 Jesse Ruderman 2012-04-05 10:01:54 PDT
It's kinda scary that it took an obscure feature (fonts in MathML) to uncover a unicharutil bug. How can that be remedied?
Comment 12 :Ehsan Akhgari (busy, don't ask for review please) 2012-04-05 11:41:14 PDT
http://hg.mozilla.org/mozilla-central/rev/d19b20df7e70

Note You need to log in before you can comment on or make changes to this bug.