665837 - "ASSERTION: negative length" with -moz-column, rtl, pre-line

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: negative length: 'GetContentEnd() - mContentOffset >= 0', file /builds/slave/cen-osx64-dbg/build/layout/generic/nsTextFrame.h, line 327

Comment 1

[Simon Montagu :smontagu]

Attachment: Patch

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 540726 [details] [diff] [review]
Patch

Review of attachment 540726 [details] [diff] [review]:
-----------------------------------------------------------------

So the problem occurs when the entire continuation chain doesn't cover all the text in the node? When did that happen? Was it just a transient state?

Comment 3

[Simon Montagu :smontagu]

Not the entire continuation chain, the sibling chain. Bug 663295 made us break off walking continuations at the last sibling. I'll edit some of the code comments to make this clearer before checking in.

Comment 4

[Daniel Veditz [:dveditz]]

Assuming sg:critical if there's also a runtime crash, please correct if wrong

Comment 5

[Simon Montagu :smontagu]

No runtime crash in either debug or opt build.

Comment 6

[Simon Montagu :smontagu]

http://hg.mozilla.org/mozilla-central/rev/99c270809649

Comment 7

[Daniel Veditz [:dveditz]]

If there's no crash then what is a crashtest testing?

Comment 8

[Jesse Ruderman]

Assertions :)  The reftest framework catches leaks and assertions in addition to crashes and hangs.  "Crashtest" is short for "Make sure nothing goes horribly and obviously wrong when loading this page".

Comment 9

[Daniel Veditz [:dveditz]]

Should this bug be unhidden then, not a security bug after all?

Comment 10

[Daniel Veditz [:dveditz]]

If it's a security bug we need to land this on mozilla-beta for firefox 6. If it's not then we should stop tracking it for 6 and move on.

Comment 11

[Simon Montagu :smontagu]

The assertion doesn't occur in a current mozilla-beta build, so comment 10 is moot.

Comment 12

[u279076]

qa- as no QA fix verification needed