The following HTML code triggers an assertion on Fennec Native (mozilla-central, debug build, rev 448f554f6acb): <script> var x = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea"); document.documentElement.appendChild(x); x.value = "\uC879\uFE08\"\uF38F\n"; </script> I verified that this assertion does not trigger on a Firefox desktop debug build.
Created attachment 625584 [details] [diff] [review] patch, explicitly select Unicode charmap when we create an FT face I've also seen this assertion on a desktop linux build with --disable-pango, which causes us to use the "FT2 fonts" backend, similarly to Android. It seems that when a font contains multiple charmaps, Freetype may not necessarily choose the Unicode one when the face is created; if it picks MacRoman, for example, then characters outside that set will not be found, even though they may be present in the font. So this patch explicitly selects the Unicode charmap after we create the face.
Tryserver build (Android) is at https://tbpl.mozilla.org/?tree=Try&rev=881c20ceb90f.