Jesse Ruderman Reporter
	Description • 16 years ago

Loading the testcase triggers a bunch of assertions:

##!!! ASSERTION: Bad offset looking for glyphrun: 'aOffset <= mCharacterCount', file gfx/thebes/src/gfxFont.cpp, line 1882

###!!! ASSERTION: Hmm, something went wrong, aOffset should have been found: 'mGlyphRuns[start].mCharacterOffset <= aOffset', file gfx/thebes/src/gfxFont.cpp, line 1897

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file gfx/thebes/src/gfxSkipChars.cpp, line 92

###!!! ASSERTION: Substring out of range: 'aStart + aLength <= mCharacterCount', file gfx/thebes/src/gfxFont.cpp, line 1646

###!!! ASSERTION: Substring out of range: 'aStart + aMaxLength <= mCharacterCount', file gfx/thebes/src/gfxFont.cpp, line 1693

###!!! ASSERTION: Text run does not map enough text for our reflow: 'gfxSkipCharsIterator(iter).ConvertOriginalToSkipped(offset + length) <= mTextRun->GetLength()', file layout/generic/nsTextFrameThebes.cpp, line 5423

###!!! ASSERTION: invalid array index: 'i < Length()', file ../../../dist/include/xpcom/nsTArray.h, line 317

	Boris Zbarsky [:bzbarsky]
	Comment 1 • 16 years ago

This looks really bad, especially that last asset.

We're calling:

5562   NS_ASSERTION(gfxSkipCharsIterator(iter).ConvertOriginalToSkipped(offset + length)
5563                     <= mTextRun->GetLength(),
5564                "Text run does not map enough text for our reflow");

in nsTextFrameReflow.  mTextRun->GetLength() is 3.  offset is 1, length is 3.  mSkipChars->mCharCount is also 3, and since 1 + 3 > 3 we hit at least some of these assertions...

The frame tree in the relevant part looks like this:

                    line 0x15eddf0: count=1 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x4000] {0,1152,4485,6720} ca={-60,1152,4800,6720} <
                      Letter(div)(0)@0x15edd8c next=0x15ee224 next-continuation=0x15ee224 {0,1152,4485,6720} [state=00000409] [content=0x7539520] [overflow=-60,0,4800,6720] [sc=0x15edc88] pst=:first-letter<
                        Text(1)@0x15edd4c[0,3,F]  next-continuation=0x15ee1ac {0,0,4485,6720} [state=00200409] [content=0x7539590] [overflow=-60,0,4800,6720] sc=0x15edcfc pst=:-moz-non-element<
                          " A "
                        >
                      >
                    >
                    line 0x15ee260: count=1 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x4100] {0,7872,640,1152} <
                      Letter(div)(0)@0x15ee224 prev-continuation=0x15edd8c {0,7968,640,960} [state=00000004] [content=0x7539520] [sc=0x15edc1c] pst=:-moz-non-element<
                        Text(1)@0x15ee1ac[3,1,T]  prev-continuation=0x15edd4c {0,0,640,960} [state=02600004] [content=0x7539590] sc=0x15ee288 pst=:-moz-non-element<
                          "B"
                        >
                      >
                    >

	Daniel Holbert [:dholbert]
	Comment 2 • 16 years ago

I get no assertions when loading the testcase, using a debug build from today.

Jesse / Boris, can you still reproduce this?

	Jesse Ruderman Reporter
	Comment 3 • 16 years ago

WFM mozilla-central, moz190, and moz181.

I'll check in a crashtest when things are more green and open.

	David Baron :dbaron:
	Comment 4 • 16 years ago

Adding the fixed1.9.1 keyword for lack of a worksforme1.9.1 keyword.