Closed Bug 663662 Opened 13 years ago Closed 13 years ago

"ASSERTION: Weird break found" with rtl, -moz-column

Categories

(Core :: Layout: Text and Fonts, defect)

Product:
Core
Component:
Layout: Text and Fonts
Version:
7 Branch
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla7
Tracking Flags:
Tracking Status
firefox6 --- unaffected
firefox7 --- fixed
status1.9.2 --- unaffected

People

(Reporter: jruderman, Assigned: smontagu)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [qa-])

Attachments

(3 files)

testcase
336 bytes, text/html
Details
stack traces
30.84 KB, text/plain
Details
Patch
2.71 KB, patch
roc
: review+
Details | Diff | Splinter Review
Attached file testcase — 
###!!! ASSERTION: Weird break found!: 'limitLength >= 0', file layout/generic/nsTextFrameThebes.cpp, line 6824

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file gfx/thebes/gfxSkipChars.cpp, line 92

###!!! ASSERTION: negative length: 'GetContentEnd() - mContentOffset >= 0', file layout/generic/nsTextFrame.h, line 327

###!!! ASSERTION: integer overflow: 'mMaxTextLength < PR_UINT32_MAX - aFrame->GetContentLength()', file layout/generic/nsTextFrameThebes.cpp, line 1437

Regression from bug 263359, I think.
Attached file stack traces — 

    
  
Assignee: nobody → smontagu

    
    

    
  
Security regression from something landed for Firefox 7, should be tracked.

          tracking-firefox7:
          --- → ?

    
    

    
  

      
      
      
      

        Attached patch
          
          
        Patch
        — 
          — Splinter Review
      

    


  
This came from not checking the definition of which characters constitute a forced line break in CSS.

        Attachment #539148 -
        Flags: review?(roc)

    
    

    
  
As assertion from a spec violation? Is that because other parts of Gecko check the right thing?

    
    

    
  
Yes, the assertion was caused by the inconsistency between nsBidiPresUtils and nsTextFrameThebes.

    
    

    
  
Comment on attachment 539148 [details] [diff] [review]
Patch

Review of attachment 539148 [details] [diff] [review]:
-----------------------------------------------------------------

        Attachment #539148 -
        Flags: review?(roc) → review+

    
    

    
  
http://hg.mozilla.org/mozilla-central/rev/bb5bd25d0788
Status: NEW → RESOLVED
Closed: 13 years ago
Flags: in-testsuite+
Resolution: --- → FIXED

    
    

    
  
Since we never shipped a release with this bug we don't need to keep it hidden.
Group: core-security

          status1.9.2:
          --- → unaffected

          status-firefox6:
          --- → unaffected

          status-firefox7:
          --- → fixed
Keywords: regression
Target Milestone: --- → mozilla7
Version: Trunk → 7 Branch

    
    

    
  
Mozilla/5.0 (X11; Linux x86_64; rv:7.0) Gecko/20100101 Firefox/7.0

Could you provide some clear steps to reproduce in order to verify this issue on QA side?

    
    

    
  
Virgil - just load the testcase in a build with assertions enabled (i.e. a debug build).

    
    

    
  
qa- as no QA fix verification needed
Whiteboard: [qa-]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: