371483 - "ASSERTION: didn't subtract all that we added" with <td colspan="2"><table style="table-layout: fixed;">

Status: RESOLVED FIXED

(Core :: Layout: Tables, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers this assertion:

###!!! ASSERTION: didn't subtract all that we added: 'totalSPref == 0 && totalSMin == 0 && totalSNonPctPref == 0 && nonPctCount == 0 && minOutsidePref == 0 && minWithinPref == 0 && info.prefCoord == 0 && (info.prefPercent == 0.0f || !spanHasNonPct)', file layout/tables/BasicTableLayoutStrategy.cpp, line 484

Comment 1

[Boris Zbarsky [:bzbarsky]]

So in this case info.prefCoord is -16.

Comment 2

[Bernd]

>So in this case info.prefCoord is -16.

Which is the result of something that was previously called NS_UNCONSTRAINEDSIZE arithmetic.

The inner table returns nscoord_MAX (aka 1<<30) which is equal to NS_UNCONSTRAINEDSIZE

then nsLayoutUtils::IntrinsicForContainer ( http://lxr.mozilla.org/seamonkey/source/layout/base/nsLayoutUtils.cpp#1369) does not bother that it can get a nscoord_MAX and happily adds to it (this time we are lucky as it add only 0).
The GetWidthInfo http://lxr.mozilla.org/seamonkey/source/layout/tables/BasicTableLayoutStrategy.cpp#105 follows the suit and adds again to nscoord_MAX but this time non zero so we get highest bit set, the sign toggles and there we are with negative widths.

While I am sure that nscoord_max arithmetic is evil, I am not sure that I would like to get the code tortured with nscoord_MAX checks.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to comment #2)
> While I am sure that nscoord_max arithmetic is evil, I am not sure that I would
> like to get the code tortured with nscoord_MAX checks.

We need to, though.  I think this may have come up in another bug.

Comment 4

[Bernd]

> I think this may have come up in another bug

Yep, all the 1.9+ bugs in tables that reference fixed layout suffer from this.
bz described this in https://bugzilla.mozilla.org/show_bug.cgi?id=367673#c1

Comment 5

[Daniel Holbert [:dholbert]]

I posted an nscoord_MAX-checking patch on bug 367673, and it covers this bug as well.

Comment 6

[Daniel Holbert [:dholbert]]

Fixed by checkin for bug 367673.

Comment 7

[Daniel Holbert [:dholbert]]

Attachment: reftest for assertion