Last Comment Bug 343588 - "ASSERTION: index out of range" involving rowspan (within nsCellMap::RebuildConsideringRows)
: "ASSERTION: index out of range" involving rowspan (within nsCellMap::RebuildC...
Status: RESOLVED FIXED
: assertion, fixed1.8.0.7, fixed1.8.1, regression, testcase
Product: Core
Classification: Components
Component: Layout: Tables (show other bugs)
: Trunk
: PowerPC Mac OS X
: -- normal (vote)
: ---
Assigned To: Bernd
:
:
Mentors:
Depends on:
Blocks: 343943 339246 346980
  Show dependency treegraph
 
Reported: 2006-07-04 14:35 PDT by Jesse Ruderman
Modified: 2007-12-16 20:26 PST (History)
2 users (show)
jruderman: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (483 bytes, application/xhtml+xml)
2006-07-04 14:36 PDT, Jesse Ruderman
no flags Details
stack trace (mac debug / gdb) (10.60 KB, text/plain)
2006-07-04 14:38 PDT, Jesse Ruderman
no flags Details
patch (3.65 KB, patch)
2006-07-04 23:08 PDT, Bernd
bzbarsky: review+
bzbarsky: superreview+
Details | Diff | Splinter Review

Description Jesse Ruderman 2006-07-04 14:35:59 PDT
This testcase causes:

###!!! ASSERTION: index out of range: '0 <= aIndex && aIndex < Count()', file ../../../dist/include/xpcom/nsVoidArray.h, line 81

This is with nsVoidArray::ElementAt (not FastElementAt) so I don't think this is a memory-safety violation.

This happens both without and with the patch in bug 343087 comment 2.
Comment 1 Jesse Ruderman 2006-07-04 14:36:48 PDT
Created attachment 228074 [details]
testcase
Comment 2 Jesse Ruderman 2006-07-04 14:38:27 PDT
Created attachment 228075 [details]
stack trace (mac debug / gdb)
Comment 3 Bernd 2006-07-04 23:04:48 PDT
this is a regression from bug 339246
Comment 4 Bernd 2006-07-04 23:08:55 PDT
Created attachment 228106 [details] [diff] [review]
patch
Comment 5 Martijn Wargers [:mwargers] (not working for Mozilla) 2006-07-06 05:06:06 PDT
I think I have a case (unminised) that crashes, but not crashes when I have the patch applied.
Comment 6 Bernd 2006-07-31 21:59:52 PDT
Comment on attachment 228106 [details] [diff] [review]
patch

I don't know why I thought I have to take aNumOrigCols instead of numCols inside nsCellMap::RebuildConsideringRows. Its plain wrong in the patch for bug 339246. Probably I played with it and then forgot to remove it.
Comment 7 Boris Zbarsky [:bz] (still a bit busy) 2006-08-01 08:09:43 PDT
Comment on attachment 228106 [details] [diff] [review]
patch

Sure.
Comment 8 Bernd 2006-08-02 05:33:09 PDT
fixed on trunk
Comment 9 Bernd 2006-08-29 12:39:09 PDT
fixed on branches by the cellmap branch patch
Comment 10 Jesse Ruderman 2007-12-16 20:26:23 PST
Crashtest checked in.

Note You need to log in before you can comment on or make changes to this bug.