347434 - "ASSERTION: index out of range" (bogus index?) involving MathML

Status: RESOLVED DUPLICATE of bug 347495

(Core :: MathML, defect)

Description

[Jesse Ruderman]

This testcase sometimes triggers the following assertion, usually within 5 to 10 reloads.

###!!! ASSERTION: index out of range: '0 <= aIndex && aIndex < Count()', file ../../../dist/include/xpcom/nsVoidArray.h, line 81

Stack trace:
nsVoidArray::ElementAt
nsStringArray::StringAt
nsGlyphTable::DrawGlyph
nsMathMLChar::PaintForeground
nsDisplayMathMLCharForeground::Paint
nsDisplayList::Paint
...

This doesn't seem like a "trying to read past the end of the array" bug.  Instead, it looks like the array index is a totally bogus value, much much larger than the size of the array.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[rbs]

Cannot reproduce with my tree that has the patch for bug 347495. Marking as dup. Re-open if it turns out not to be the case.

*** This bug has been marked as a duplicate of 347495 ***