Closed Bug 371483 Opened 14 years ago Closed 13 years ago

"ASSERTION: didn't subtract all that we added" with <td colspan="2"><table style="table-layout: fixed;">

Categories

(Core :: Layout: Tables, defect)

x86
All
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: dholbert)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [nscoord_MAX arithmetic])

Attachments

(2 files)

Attached file testcase
Loading the testcase triggers this assertion:

###!!! ASSERTION: didn't subtract all that we added: 'totalSPref == 0 && totalSMin == 0 && totalSNonPctPref == 0 && nonPctCount == 0 && minOutsidePref == 0 && minWithinPref == 0 && info.prefCoord == 0 && (info.prefPercent == 0.0f || !spanHasNonPct)', file layout/tables/BasicTableLayoutStrategy.cpp, line 484
So in this case info.prefCoord is -16.
Flags: blocking1.9?
Flags: blocking1.9? → blocking1.9+
Assignee: nobody → dbaron
>So in this case info.prefCoord is -16.

Which is the result of something that was previously called NS_UNCONSTRAINEDSIZE arithmetic.

The inner table returns nscoord_MAX (aka 1<<30) which is equal to NS_UNCONSTRAINEDSIZE

then nsLayoutUtils::IntrinsicForContainer ( http://lxr.mozilla.org/seamonkey/source/layout/base/nsLayoutUtils.cpp#1369) does not bother that it can get a nscoord_MAX and happily adds to it (this time we are lucky as it add only 0).
The GetWidthInfo http://lxr.mozilla.org/seamonkey/source/layout/tables/BasicTableLayoutStrategy.cpp#105 follows the suit and adds again to nscoord_MAX but this time non zero so we get highest bit set, the sign toggles and there we are with negative widths.

While I am sure that nscoord_max arithmetic is evil, I am not sure that I would like to get the code tortured with nscoord_MAX checks.


(In reply to comment #2)
> While I am sure that nscoord_max arithmetic is evil, I am not sure that I would
> like to get the code tortured with nscoord_MAX checks.

We need to, though.  I think this may have come up in another bug.
Whiteboard: [nscoord_MAX arithmetic]
> I think this may have come up in another bug

Yep, all the 1.9+ bugs in tables that reference fixed layout suffer from this.
bz described this in https://bugzilla.mozilla.org/show_bug.cgi?id=367673#c1
Blocks: 374927
OS: Mac OS X → All
Assignee: dbaron → dholbert
Status: NEW → ASSIGNED
I posted an nscoord_MAX-checking patch on bug 367673, and it covers this bug as well.
Depends on: 367673
Fixed by checkin for bug 367673.
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Depends on: 368573
Flags: in-testsuite?
Attachment #282454 - Flags: review?(roc)
Attachment #282454 - Attachment description: reftest → reftest for assertion
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.