1743637 - Fix array out of bounds in nsTextFrame::ToCString

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect, P3)

Description

[Miko Mynttinen]

Noticed that this caused a crash when calling nsIFrame::GetFrameName() when running for example dom/tests/mochitest/dom-level1-core/test_hc_characterdatadeletedataexceedslength.html.

 0:46.91 GECKO(471795) GetContentLength(): 5, frag->GetLength(): 4
 0:46.91 GECKO(471795) Assertion failure: aIndex < mState.mLength (bad index), at /home/miko/Code/mu3/dom/base/nsTextFragment.h:219
Initializing stack-fixing for the first stack frame, this may take a while...
 1:01.89 GECKO(471795) #01: nsTextFragment::CharAt(unsigned int) const (/home/miko/Code/mu3/dom/base/nsTextFragment.h:219)
 1:01.89 GECKO(471795) #02: nsTextFrame::ToCString(nsTString<char>&, int*) const (/home/miko/Code/mu3/layout/generic/nsTextFrame.cpp:10263)
 1:01.90 GECKO(471795) #03: nsTextFrame::GetFrameName(nsTSubstring<char16_t>&) const (/home/miko/Code/mu3/layout/generic/nsTextFrame.cpp:10282)

Comment 1

[Miko Mynttinen]

Attachment: Bug 1743637 - Fix array out of bounds in nsTextFrame::ToCString r=emilio

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e86bd6c22ef7
Fix array out of bounds in nsTextFrame::ToCString r=emilio

Comment 3

[Sandor Molnar[:smolnar]]

Backed out for causing android failures

Backout link: https://hg.mozilla.org/integration/autoland/rev/b72e28915eff25f3fc1365f063bfd528eca91f1b

Push with failures

Failure log

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7af79a49bf5f
Fix array out of bounds in nsTextFrame::ToCString r=emilio

Comment 5

[Cristina Cozmuta (:CrissCozmuta)]

https://hg.mozilla.org/mozilla-central/rev/7af79a49bf5f

Comment 6

[Noemi Erli[:noemi_erli]]

Backed out changeset 7af79a49bf5f (Bug 1743637) for causing perma geckoview failures

Log: https://treeherder.mozilla.org/logviewer?job_id=359959315&repo=autoland&lineNumber=14463

Range: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=pending%2Crunning%2Csuccess%2Ctestfailed%2Cbusted%2Cexception%2Crunnable&searchStr=android%2C7.0%2Cx86-64%2Clite%2Cwebrender%2Cdebug%2Ctest-android-em-7.0-x86_64-lite-qr%2Fdebug-geckoview-junit-e10s-single-e10s%2Cgv-junit-e10s-single&fromchange=d383983b68e25544e2578348073e1f4e907b6969&tochange=815bbe6ee2b0b736cbbbcf74fb15099e5e9977b9

Comment 7

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8290bc0f4ceb
Backed out changeset 7af79a49bf5f for causing perma geckoview failures

Comment 8

[Cosmin Sabou [:CosminS]]

Backout merged to central: https://hg.mozilla.org/mozilla-central/rev/8290bc0f4cebe33a586feabe5d9040dedcd6a94d

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/02d8ea288aad
Fix array out of bounds in nsTextFrame::ToCString r=emilio

Comment 10

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/02d8ea288aad