"ASSERTION: index out of range" involving rowspan (within nsCellMap::RebuildConsideringRows)

RESOLVED FIXED

Status

()

Core
Layout: Tables
RESOLVED FIXED
11 years ago
10 years ago

People

(Reporter: Jesse Ruderman, Assigned: Bernd)

Tracking

(Blocks: 1 bug, 5 keywords)

Trunk
PowerPC
Mac OS X
assertion, fixed1.8.0.7, fixed1.8.1, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

11 years ago
This testcase causes:

###!!! ASSERTION: index out of range: '0 <= aIndex && aIndex < Count()', file ../../../dist/include/xpcom/nsVoidArray.h, line 81

This is with nsVoidArray::ElementAt (not FastElementAt) so I don't think this is a memory-safety violation.

This happens both without and with the patch in bug 343087 comment 2.
(Reporter)

Comment 1

11 years ago
Created attachment 228074 [details]
testcase
(Reporter)

Comment 2

11 years ago
Created attachment 228075 [details]
stack trace (mac debug / gdb)
(Assignee)

Comment 3

11 years ago
this is a regression from bug 339246
Keywords: regression
(Assignee)

Comment 4

11 years ago
Created attachment 228106 [details] [diff] [review]
patch
Assignee: nobody → bernd_mozilla
Status: NEW → ASSIGNED
(Reporter)

Updated

11 years ago
Blocks: 339246
I think I have a case (unminised) that crashes, but not crashes when I have the patch applied.
(Reporter)

Updated

11 years ago
Blocks: 343943
(Assignee)

Comment 6

11 years ago
Comment on attachment 228106 [details] [diff] [review]
patch

I don't know why I thought I have to take aNumOrigCols instead of numCols inside nsCellMap::RebuildConsideringRows. Its plain wrong in the patch for bug 339246. Probably I played with it and then forgot to remove it.
Attachment #228106 - Flags: superreview?(bzbarsky)
Attachment #228106 - Flags: review?(bzbarsky)
Comment on attachment 228106 [details] [diff] [review]
patch

Sure.
Attachment #228106 - Flags: superreview?(bzbarsky)
Attachment #228106 - Flags: superreview+
Attachment #228106 - Flags: review?(bzbarsky)
Attachment #228106 - Flags: review+
(Assignee)

Comment 8

11 years ago
fixed on trunk
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
(Assignee)

Updated

11 years ago
Blocks: 346980
(Assignee)

Comment 9

11 years ago
fixed on branches by the cellmap branch patch
Keywords: fixed1.8.0.7, fixed1.8.1
(Reporter)

Comment 10

10 years ago
Crashtest checked in.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.