ASSERTION: Negative Width Input - very bad: 'mComputedWidth >= 0'

RESOLVED WORKSFORME

Status

()

defect
RESOLVED WORKSFORME
13 years ago
11 years ago

People

(Reporter: jruderman, Unassigned)

Tracking

({assertion, testcase})

Trunk
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

13 years ago
Steps to reproduce:
1. Load a page containing <TEXTAREA COLS="381762666">.

Result:

###!!! ASSERTION: Negative Width Input - very bad: 'mComputedWidth >= 0', file /Users/admin/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 2570
Break: at file /Users/admin/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 2570

My guess is that cols is multiplied by something, leading to an integer overflow.  lg 381762666 = 28.5.
(Reporter)

Comment 1

13 years ago
Posted file testcase
OS: MacOS X → All
Hardware: Macintosh → All
Yeah the problem is in nsHTMLReflowState::ComputeHorizontalValue these lines:
2305       nsStyleContext* styleContext = frame->GetStyleContext();
2306       SetFontFromStyle(rendContext, styleContext);
2307       nscoord fontWidth;
2308       rendContext->GetWidth('M', fontWidth);
2309       aResult = aCoord.GetIntValue() * fontWidth;

fontWidth is 120, aCoord.GetIntValue() returns 67108864.
(Reporter)

Comment 3

12 years ago
WFM, Mac trunk debug.
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → WORKSFORME
(Reporter)

Comment 4

11 years ago
Crashtest checked in.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.