898951 - SVG text crash [@ mozilla::CharIterator::GetOriginalGlyphOffsets]

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file gfx/thebes/gfxSkipChars.cpp, line 61

###!!! ASSERTION: aPos out of range: 'aPos < GetLength()', file gfxFont.h, line 2673

Crash [@ mozilla::CharIterator::GetOriginalGlyphOffsets]

bp-fd40aa3a-c8bd-43ca-b718-754162130729

Comment 1

[Jesse Ruderman]

Attachment: stacks

Comment 2

[Cameron McCormack (:heycam)]

With the undisplayed character in the middle of the ligature, we're not passing in the right values to mTextRun->GetAdvanceWidth in CharIterator::GetGlyphPartialAdvance.  We'll need to interpret aPartOffset and aPartLength as values that include those undisplayed characters, converting them into skipped offsets to pass in to GetAdvanceWidth.

Comment 3

[Cameron McCormack (:heycam)]

Attachment: patch

It turned out to be easier to keep aPartLength not counting undisplayed characters, and to fix up the value in the caller of GetGlyphPartialAdvance.  I removed aPartOffset since we were only ever calling it with 0, and it made it easier to track the undisplayed characters within the glyph in CharIterator if we assumed we'd always want the number of undisplayed characters from the beginning of the glyph.

Note that nsSVGTextFrame2::DoTextPathLayout doesn't need fixing up, since the indexes it is using are indexes into mPositions, which already does not include undisplayed characters.

Comment 4

[Cameron McCormack (:heycam)]

https://tbpl.mozilla.org/?tree=Try&rev=f435ef5f9755

Comment 5

[Scoobidiver (away)]

No crash on Windows for me.

(In reply to Jesse Ruderman from comment #0)
> bp-fd40aa3a-c8bd-43ca-b718-754162130729
Build ID 	20130723030205
Does it happen with the latest Nightly?

Comment 6

[Jesse Ruderman]

Yes, it happens in a newer Nightly.  bp-6c654d68-c77b-4f7a-ac63-368c52130729

Comment 7

[Cameron McCormack (:heycam)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/29ac72d08730

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/29ac72d08730