Last Comment Bug 495875 - Crash [@ BuildTextRunsScanner::BreakSink::SetBreaks] with -moz-column, pre-wrap, font-size-adjust, multiple text runs
: Crash [@ BuildTextRunsScanner::BreakSink::SetBreaks] with -moz-column, pre-wr...
Status: RESOLVED FIXED
: [sg:critical?]
: assertion, crash, regression, testcase, verified1.9.1
Product: Core
Classification: Components
Component: Layout
: Trunk
: All All
: P2 critical (vote)
: ---
Assigned To: Simon Montagu
: layout
:
:
: 306939 377438 465928
  Show dependency treegraph
 
Reported: 2009-06-01 15:20 PDT by Jesse Ruderman
Modified: 2010-02-27 12:51 PST (History)
7 users (show)
roc: blocking1.9.2+
samuel.sidler+old: wanted1.9.0.x-
jruderman: in‑testsuite+
See Also:
Crash Signature:
[@ BuildTextRunsScanner::BreakSink::SetBreaks]
  ---
  ---
  ---
  ---
  ---
  ---
  ---
  ---
  ---
  ---
  ---
  ---
  beta2-fixed
  .6+
  .6-fixed


Attachments
testcase (crashes Firefox when loaded) (241 bytes, text/html)
2009-06-01 15:20 PDT, Jesse Ruderman
no flags Details
Testcase without bidi (248 bytes, text/html)
2009-10-11 09:30 PDT, Simon Montagu
no flags Details
Patch (2.55 KB, patch)
2009-10-12 08:12 PDT, Simon Montagu
roc: review+
roc: superreview+
dveditz: approval1.9.1.6+
Details | Diff | Splinter Review

Summon comment box

Description Jesse Ruderman 2009-06-01 15:20:38 PDT
Created attachment 380929 [details]
testcase (crashes Firefox when loaded)

###!!! ASSERTION: Flag set that should never be set! (memory safety error?): '!(mTextRun->GetFlags() & (gfxTextRunWordCache::TEXT_UNUSED_FLAGS | nsTextFrameUtils::TEXT_UNUSED_FLAG))', file /Users/jruderman/central/layout/generic/nsTextFrameThebes.cpp, line 766

or

Crash [@ BuildTextRunsScanner::BreakSink::SetBreaks] touching random a memory location.
Comment 1 Jesse Ruderman 2009-06-15 17:43:53 PDT
Still crashes on mozilla-central.
Comment 2 Simon Montagu 2009-10-11 09:30:10 PDT
Created attachment 405772 [details]
Testcase without bidi

I can only reproduce the crash in debug builds. It turns out that it doesn't depend on bidi but rather on having multiple text runs in the same line, as this variation on the testcase shows.
Comment 3 Simon Montagu 2009-10-12 03:57:01 PDT
Interestingly, this is debug-only on Linux, but not on OS X.
It's a regression from bug 465928, and I think I have a patch.
Comment 4 Simon Montagu 2009-10-12 08:12:33 PDT
Created attachment 405854 [details] [review]
Patch

This passed unit tests on tryserver.
Comment 5 Robert O'Callahan (:roc) (Mozilla Corporation) 2009-10-12 15:39:20 PDT
Comment on attachment 405854 [details] [review]
Patch

Thanks
Comment 7 Daniel Veditz 2009-10-15 13:52:41 PDT
Does this bug affect 1.9.0?
Comment 8 Simon Montagu 2009-10-18 03:22:47 PDT
(In reply to comment #7)
> Does this bug affect 1.9.0?

No, the code that caused the regression was never checked in to 1.9.0, and neither test case crashes there.
Comment 10 Samuel Sidler (old account; do not CC) 2009-11-04 17:52:18 PST
Simon, is this patch ready for 1.9.1? If so (and assuming it applies), please request approval on it. Code freeze for 1.9.1.6 is November 10 at 11:59pm.
Comment 11 Simon Montagu 2009-11-05 00:42:34 PST
Comment on attachment 405854 [details] [review]
Patch

Requesting approval for 1.9.1.6.

This fixes a regression from bug 465928, which is one of the dependencies of performance bug 430332. I don't see any regression in performance in the test case there with this patch.
Comment 12 Daniel Veditz 2009-11-06 11:31:26 PST
Comment on attachment 405854 [details] [review]
Patch

Approved for 1.9.1.6, a=dveditz for release-drivers
Comment 14 Al Billings [:abillings] 2009-11-10 16:41:20 PST
Verified on OS X with attached testcase. Crashes in 1.9.1.5 but not in the nightly 1.9.1.6 build, Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.6pre) Gecko/20091110 Shiretoko/3.5.6pre.

Note You need to log in before you can comment on or make changes to this bug.