Closed Bug 343588 Opened 13 years ago Closed 13 years ago

"ASSERTION: index out of range" involving rowspan (within nsCellMap::RebuildConsideringRows)

Categories

(Core :: Layout: Tables, defect)

PowerPC
macOS
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: bernd_mozilla)

References

(Blocks 1 open bug)

Details

(5 keywords)

Attachments

(3 files)

This testcase causes:

###!!! ASSERTION: index out of range: '0 <= aIndex && aIndex < Count()', file ../../../dist/include/xpcom/nsVoidArray.h, line 81

This is with nsVoidArray::ElementAt (not FastElementAt) so I don't think this is a memory-safety violation.

This happens both without and with the patch in bug 343087 comment 2.
Attached file testcase
this is a regression from bug 339246
Keywords: regression
Attached patch patchSplinter Review
Assignee: nobody → bernd_mozilla
Status: NEW → ASSIGNED
Blocks: 339246
I think I have a case (unminised) that crashes, but not crashes when I have the patch applied.
Blocks: 343943
Comment on attachment 228106 [details] [diff] [review]
patch

I don't know why I thought I have to take aNumOrigCols instead of numCols inside nsCellMap::RebuildConsideringRows. Its plain wrong in the patch for bug 339246. Probably I played with it and then forgot to remove it.
Attachment #228106 - Flags: superreview?(bzbarsky)
Attachment #228106 - Flags: review?(bzbarsky)
Comment on attachment 228106 [details] [diff] [review]
patch

Sure.
Attachment #228106 - Flags: superreview?(bzbarsky)
Attachment #228106 - Flags: superreview+
Attachment #228106 - Flags: review?(bzbarsky)
Attachment #228106 - Flags: review+
fixed on trunk
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Blocks: 346980
fixed on branches by the cellmap branch patch
Crashtest checked in.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.