Bugzilla@Mozilla – Bug 495875
Crash [@ BuildTextRunsScanner::BreakSink::SetBreaks] with -moz-column, pre-wrap, font-size-adjust, multiple text runs
Last modified: 2010-02-27 12:51:02 PST
Summon comment box
Created attachment 380929 [details] testcase (crashes Firefox when loaded) ###!!! ASSERTION: Flag set that should never be set! (memory safety error?): '!(mTextRun->GetFlags() & (gfxTextRunWordCache::TEXT_UNUSED_FLAGS | nsTextFrameUtils::TEXT_UNUSED_FLAG))', file /Users/jruderman/central/layout/generic/nsTextFrameThebes.cpp, line 766 or Crash [@ BuildTextRunsScanner::BreakSink::SetBreaks] touching random a memory location.
Still crashes on mozilla-central.
Created attachment 405772 [details] Testcase without bidi I can only reproduce the crash in debug builds. It turns out that it doesn't depend on bidi but rather on having multiple text runs in the same line, as this variation on the testcase shows.
Interestingly, this is debug-only on Linux, but not on OS X. It's a regression from bug 465928, and I think I have a patch.
Created attachment 405854 [details] [review] Patch This passed unit tests on tryserver.
Comment on attachment 405854 [details] [review] Patch Thanks
http://hg.mozilla.org/mozilla-central/rev/28ac205d2563
Does this bug affect 1.9.0?
(In reply to comment #7) > Does this bug affect 1.9.0? No, the code that caused the regression was never checked in to 1.9.0, and neither test case crashes there.
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/e82b9a962a9f
Simon, is this patch ready for 1.9.1? If so (and assuming it applies), please request approval on it. Code freeze for 1.9.1.6 is November 10 at 11:59pm.
Comment on attachment 405854 [details] [review] Patch Requesting approval for 1.9.1.6. This fixes a regression from bug 465928, which is one of the dependencies of performance bug 430332. I don't see any regression in performance in the test case there with this patch.
Comment on attachment 405854 [details] [review] Patch Approved for 1.9.1.6, a=dveditz for release-drivers
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/98a52f52cbe5
Verified on OS X with attached testcase. Crashes in 1.9.1.5 but not in the nightly 1.9.1.6 build, Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.6pre) Gecko/20091110 Shiretoko/3.5.6pre.