Closed Bug 306533 Opened 19 years ago Closed 19 years ago

[FIX]###!!! ASSERTION: out of bounds: 'PRInt32(aIndex) >= 0 && aIndex <= length', file nsChildIterator.h, line 133

Categories

(Core :: Layout: Block and Inline, defect, P3)

Product:
Core
Component:
Layout: Block and Inline
Platform:
x86
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla1.9alpha1

People

(Reporter: MatsPalmgren_bugz, Assigned: bzbarsky)

References

Details

(Keywords: testcase, verified1.8.0.12, verified1.8.1.4)

Attachments

(4 files, 1 obsolete file)

Testcase
617 bytes, text/html
Details
stack + some data
11.41 KB, text/plain
Details
Updated to comments
2.10 KB, patch
Details | Diff | Splinter Review
1.8 branch version
2.44 KB, patch
dveditz
: approval1.8.1.4+
dveditz
: approval1.8.0.12+
Details | Diff | Splinter Review 
###!!! ASSERTION: out of bounds: 'PRInt32(aIndex) >= 0 && aIndex <= length',
file nsChildIterator.h, line 133

STEPS TO REPRODUCE
1. load attached testcase
2. click on the text

ACTUAL RESULTS
The first letter is displayed twice.
The above assertion when clicking on it.

EXPECTED RESULTS
Only two 'c' - not three.
No assertion.
Attached file Testcase — 

  

  



    
    

    
  

      
      
      
      

        Attached file
          
        stack + some data
        — 
      

    


  

  

  



    
    

    
  
I filed bug 319603 on the duplication of the "c", for what it's worth.

  

  



    
    

    
  

      
      
      
      

        Attached patch
          
          
        Proposed patch (obsolete)
        — 
          — Splinter Review
      

    


  

  

  


Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED

        Attachment #205328 -
        Flags: superreview?(roc)

        Attachment #205328 -
        Flags: review?(roc)

    
  
Priority: -- → P3
Summary: ###!!! ASSERTION: out of bounds: 'PRInt32(aIndex) >= 0 && aIndex <= length', file nsChildIterator.h, line 133 → [FIX]###!!! ASSERTION: out of bounds: 'PRInt32(aIndex) >= 0 && aIndex <= length', file nsChildIterator.h, line 133
Target Milestone: --- → mozilla1.9alpha

        Attachment #205328 -
        Flags: superreview?(roc)

        Attachment #205328 -
        Flags: superreview+

        Attachment #205328 -
        Flags: review?(roc)

        Attachment #205328 -
        Flags: review+

    
    

    
  
Remove the second 1) in the comment? and end it with a dot?

  

  



    
    

    
  


  

  

  



        Attachment #205328 -
        Attachment is obsolete: true

    
    

    
  
Fixed

  

  


Status: ASSIGNED → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED

    
    

    
  


  
Branch version of the patch. We need this on the branch to fix the crash in bug 369542.

  

  



        Attachment #256573 -
        Flags: approval1.8.1.3?

        Attachment #256573 -
        Flags: approval1.8.0.11?
Flags: blocking1.8.1.4+
Flags: blocking1.8.0.12+

    
    

    
  
Comment on attachment 256573 [details] [diff] [review]
1.8 branch version

approved for 1.8/1.8.0 branches, a=dveditz for drivers

  

  



        Attachment #256573 -
        Flags: approval1.8.1.4?

        Attachment #256573 -
        Flags: approval1.8.1.4+

        Attachment #256573 -
        Flags: approval1.8.0.12?

        Attachment #256573 -
        Flags: approval1.8.0.12+

    
    

    
  
Fixed on branches.

  

  


Keywords: fixed1.8.0.12, 
          
            fixed1.8.1.4
Status: RESOLVED → VERIFIED
Keywords: fixed1.8.0.12, 
          
            fixed1.8.1.4 → verified1.8.0.12, 
          
            verified1.8.1.4

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: