429960 - "ASSERTION: Shouldn't be incomplete if availableHeight is UNCONSTRAINED" with -moz-column, rtl, contenteditable

Status: RESOLVED WORKSFORME

(Core :: Layout: Text and Fonts, defect)

Description

[Jesse Ruderman]

Attachment: testcase A

Both testcases trigger:

###!!! ASSERTION: Shouldn't be incomplete if availableHeight is UNCONSTRAINED.: 'aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockFrame.cpp, line 1403

###!!! ASSERTION: negative length: 'GetContentEnd() - mContentOffset >= 0', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextFrame.h, line 303


Testcase A also triggers:

###!!! ASSERTION: integer overflow: 'mMaxTextLength <= mMaxTextLength + aFrame->GetContentLength()', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp, line 1078

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92


Testcase B also triggers:

###!!! ASSERTION: Attempting to allocate excessively large array: 'Error', file nsTArray.cpp, line 69

Comment 1

[Jesse Ruderman]

Attachment: testcase B

Comment 2

[Jesse Ruderman]

The scarier assertions are all gone.  Now I just get the first assertion in comment 0, and a few ordinary editor assertions.

Comment 3

[Jesse Ruderman]

The scary assertions are back.

Comment 4

[Mats Palmgren (inactive)]

I get different and somewhat less scary assertions (on Linux):

###!!! ASSERTION: bad action nesting!: 'mActionNesting>0', file /usr/moz/hg3/editor/libeditor/html/nsHTMLEditRules.cpp, line 387
###!!! ASSERTION: no frame, see bug #188946: 'frame', file /usr/moz/hg3/editor/libeditor/base/nsEditor.cpp, line 4082
###!!! ASSERTION: No first node!: 'mFirst', file /usr/moz/hg3/content/base/src/nsContentIterator.cpp, line 910

(same for both testcases)

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

On Linux mozilla-central I'm seeing the same as comment 4.

Comment 6

[Jesse Ruderman]

Same here.  That makes this bug WFM.

Comment 7

[Mats Palmgren (inactive)]

Landed the crashtests:
https://hg.mozilla.org/integration/mozilla-inbound/rev/39cf267db341

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/39cf267db341