If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

"ASSERTION: Shouldn't return empty rect" with CSS filter

NEW
Unassigned

Status

()

Core
Layout
2 years ago
8 months ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
assertion, testcase
Points:
---

Firefox Tracking Flags

(firefox48 affected)

Details

Attachments

(2 attachments)

(Reporter)

Description

2 years ago
Created attachment 8732044 [details]
testcase

###!!! ASSERTION: Shouldn't return empty rect: '!mTmp.IsEmpty()', file nsRegion.h, line 375
(Reporter)

Comment 1

2 years ago
Created attachment 8732045 [details]
stack
The box has x1 = -180, x2 = 2147483580, so when it's converted to a rect the width is x2-x1 = 2147483580 + 180, which overflows negative since these are signed 32 bit ints. And negative widths are interpreted as empty.

Updated

8 months ago
Assignee: nobody → cku

Updated

8 months ago
Assignee: cku → nobody
You need to log in before you can comment on or make changes to this bug.