Loading the testcase triggers: ###!!! ASSERTION: Range out of bounds: 'IsInBounds(mStart, mLength, aStart, aLength)', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp, line 2350

In this case the bidi resolver is breaking the text into two frames, the second being a non-fluid continuation. However the two frames have the same direction. So they share a textrun and we have two flows in the textrun with the same content. This violates the invariant that there are no two flows in a textrun with the same content. My solution here is to directly detect two flows with the same content and ensure that the second flow is placed in its own textrun.

Comment on attachment 284902 [details] [diff] [review] fix r=me, but I wonder if the bidi resolver still needs to do that. In the old gfx implementations we had to break the frames because we couldn't render a run of text containing characters with different native directions (equivalent to the charType property) but the same resolved direction (the embeddingLevel property) in a single operation, but today I should think that that isn't a problem.

Yeah. Well, feel free to fix the underlying bug; if you do, you can change this into an assertion.

checked in

Backed out in case it caused pref regression.

re-landed: Checking in layout/generic/nsTextFrameThebes.cpp; /cvsroot/mozilla/layout/generic/nsTextFrameThebes.cpp,v <-- nsTextFrameThebes.cpp new revision: 3.113; previous revision: 3.112 done

Crashtest checked in.

verified fixed using the testcase and Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b4pre) Gecko/2008020601 Firefox/3.0b4pre -> no assertion like described in comment #0 - Verified fixed