266406 - ###!!! ASSERTION: Integer too big to fit: 'tmp / NS_ATTRVALUE_INTEGERTYPE_MULTIPLIER == aValue', file r:\mozilla\content\base\src\nsAttrValue.h, line 323

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[timeless]

JavaScript strict warning: http://www.sbs.co.kr/, line 1432: function onEnter does not always return a 
value
JavaScript strict warning: http://www.sbs.co.kr/, line 1440: function onSearch does not always return a 
value
CSS Error (http://www.sbs.co.kr/ :0.12): Error in parsing value for property 'CURSOR'.  Declaration 
dropped.
###!!! ASSERTION: Integer too big to fit: 'tmp / NS_ATTRVALUE_INTEGERTYPE_MULTIPLIER == aValue', 
file r:\mozilla\content\base\src\nsAttrValue.h, line 323
Break: at file r:\mozilla\content\base\src\nsAttrValue.h, line 323

 	xpcom_core.dll!nsDebug::Assertion(const char * aStr=0x01d13b94, const char * 
aExpr=0x01d13bac, const char * aFile=0x01d13b68, int aLine=0x00000143)  Line 109
	C++
>	gklayout.dll!nsAttrValue::SetIntValueAndType(int aValue=0x07ffffff, nsAttrValue::ValueType 
aType=eInteger)  Line 323 + 0x2a	C++
 	gklayout.dll!nsAttrValue::ParseIntWithBounds(const nsAString & aString={...}, int 
aMin=0x00000000, int aMax=0x07ffffff)  Line 831	C++
 	gklayout.dll!nsHTMLInputElement::ParseAttribute(nsIAtom * aAttribute=0x00fe0880, const 
nsAString & aValue={...}, nsAttrValue & aResult={...})  Line 1776 + 0x12
	C++
 	gklayout.dll!nsGenericHTMLElement::SetAttr(int aNamespaceID=0x0012f7cc, nsIAtom * 
aAttribute=0x0012f710, nsIAtom * aPrefix=0x01c360f7, const nsAString & aValue={...}, unsigned int 
aLineNo=0x00000000, int aNotify=0x07ffffff)  Line 1655 + 0x14
	C++
 	gklayout.dll!nsGenericHTMLElement::SetAttr(int aNamespaceID=0x00000000, nsIAtom * 
aAttribute=0x00fe0880, nsIAtom * aPrefix=0x00000000, const nsAString & aValue={...}, int 
aNotify=0x00000000)  Line 1612	C++
 	gklayout.dll!nsGenericHTMLFormElement::SetAttr(int aNameSpaceID=0x0012f710, nsIAtom * 
aName=0x01c360f7, nsIAtom * aPrefix=0x0012fa44, const nsAString & aValue={...}, int 
aNotify=0x07ffffff)  Line 3440	C++
 	gklayout.dll!nsHTMLInputElement::SetAttr(int aNameSpaceID=0x00000000, nsIAtom * 
aName=0x00fe0880, nsIAtom * aPrefix=0x00000000, const nsAString & aValue={...}, int 
aNotify=0x00000000)  Line 212	C++
 	gklayout.dll!HTMLContentSink::AddAttributes(const nsIParserNode & aNode={...}, nsIContent * 
aContent=0x0012fa44, int aNotify=0x00000000, int aCheckIfPresent=0x07ffffff)  Line 848
	C++
 	gklayout.dll!SinkContext::AddLeaf(const nsIParserNode & aNode={...})  Line 1490
	C++
 	gklayout.dll!HTMLContentSink::AddLeaf(const nsIParserNode & aNode={...})  Line 3126
	C++
 	gkparser.dll!CNavDTD::AddLeaf(const nsIParserNode * aNode=0x03a4c2b0)  Line 3760 + 0xd
	C++
 	gkparser.dll!CNavDTD::HandleDefaultStartToken(CToken * aToken=0x03187e00, nsHTMLTag 
aChildTag=eHTMLTag_a, nsCParserNode * aNode=0x03a4c2b0)  Line 1432 + 0x8
	C++
 	gkparser.dll!CNavDTD::HandleStartToken(CToken * aToken=0x00000035)  Line 1807 + 0xe
	C++
 	gkparser.dll!CNavDTD::HandleToken(CToken * aToken=0x00000035, nsIParser * 
aParser=0x02cd91c8)  Line 992 + 0xa	C++
 	gkparser.dll!CNavDTD::BuildModel(nsIParser * aParser=0x02cd91c8, nsITokenizer * 
aTokenizer=0x03acf280, nsITokenObserver * anObserver=0x00000000, nsIContentSink * 
aSink=0x039f3510)  Line 471 + 0xa	C++
 	gkparser.dll!nsParser::BuildModel()  Line 1919	C++
 	gkparser.dll!nsParser::ResumeParse(int allowIteration=0x00000001, int 
aIsFinalChunk=0x00000001, int aCanInterrupt=0x00000001)  Line 1784 + 0x6
	C++
 	gkparser.dll!nsParser::ContinueParsing()  Line 1362 + 0xc
	C++
 	gkparser.dll!nsParser::HandleParserContinueEvent()  Line 1426
	C++
 	gkparser.dll!nsParserContinueEvent::HandleEvent(PLEvent * aEvent=0x0327a4c0)  Line 237
	C++
 	xpcom_core.dll!PL_HandleEvent(PLEvent * self=0x0327a4c0)  Line 693
	C
 	xpcom_core.dll!PL_ProcessPendingEvents(PLEventQueue * self=0x01062b08)  Line 628
	C
 	xpcom_core.dll!_md_TimerProc(HWND__ * hwnd=0x002727ea, unsigned int uMsg=0x00000113, 
unsigned int idEvent=0x00000000, unsigned long dwTime=0x1d569da7)  Line 998 + 0x6
	C
 	user32.dll!77d43a50() 	
 	user32.dll!GetSysColor()  + 0x10f	
 	user32.dll!TranslateMessage()  + 0x8d	
 	user32.dll!DispatchMessageW()  + 0xb	
 	appshell.dll!nsAppShellService::Run()  Line 484	C++
 	mozilla.exe!main1(int argc=0x0012fa44, char * * argv=0x00000000, nsISupports * 
nativeApp=0x07ffffff)  Line 1336	C++
 	mozilla.exe!main(int argc=0x00000001, char * * argv=0x003f7c10)  Line 1827 + 0x16
	C++
 	mozilla.exe!mainCRTStartup()  Line 400 + 0x11	C
 	kernel32.dll!TermsrvAppInstallMode()  + 0x269	

nsHTMLInputElement::ParseAttribute should pass an upper bound to nsAttrValue::ParseIntWithBounds, 
the default is too big.

Comment 1

[timeless]

sicking: can we make this a warning?

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Somethings not good here. Either we should make the default upper bound smaller,
or we should fix nsAttrValue so that it can store larger ints (they would be
stored in the OtherContainer)

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Attachment: patch to fix

I had just counted the bits wrong. In a signed 4 bit integer the maximum value
is (1 << _3_) - 1

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 171955 [details] [diff] [review]
patch to fix

r+sr=jst

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Checked in, thanks for finding this, and for the review.