841174 - Out of bounds in nsSVGTextFrame2::DoAnchoring with svg.text.css-frames.enabled

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

With:
  user_pref("svg.text.css-frames.enabled", true);

Assertion failure: i < Length() (invalid array index), at ../../dist/include/nsTArray.h:632

[@ nsSVGTextFrame2::DoAnchoring]

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Cameron McCormack (:heycam)]

Attachment: patch

The test has a ::first-letter that applies to a combining character.  As part of the text frame splitting done by the ::first-letter handling, there is an empty nsTextFrame (its content length is 0) followed by a non-empty nsContinuingTextFrame (its content offset is 0 and content length is 2).  The IsNonEmptyTextFrame function was meant to handle empty text frames like this, but it was looking at the corresponding content nsTextNode to see if it is empty.  In this case, the empty nsTextFrame's corresponding nsTextNode is the single nsTextNode that contains the combining mark and the following normal character.  So it was being treated as a non-empty nsTextFrame.

The patch changes IsNonEmptyTextFrame to look at the actual content length value on the nsTextFrame to determine if it is empty, which works both with the other cases that IsNonEmptyTextFrame worked for (empty text nodes created with createTextNode()) and this case where the text is split due to ::first-letter.

Comment 3

[Jonathan Watt [:jwatt]]

Thanks for the clear description.

Comment 4

[Cameron McCormack (:heycam)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/47651a71a556

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/47651a71a556