385426 - "ASSERTION: bad index" in nsTextFragment.h with right-to-left-override and soft-hyphen characters

Status: VERIFIED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: bad index: 'PRUint32(aIndex) < mState.mLength', file /Users/jruderman/trunk/mozilla/layout/base/../../content/base/src/nsTextFragment.h, line 184

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

Just need to bounds-check this. When all characters in the text frame have been discarded, the nsSkipCharsRunIterator gets positioned off at the first non-discarded character (or the end of the string), so the first skipped character before that position may not belong to this frame.

Comment 2

[Simon Montagu :smontagu]

Comment on attachment 278526 [details] [diff] [review]
fix

I assume this review request was intended for me :)

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Checked in

Comment 4

[Carsten Book [:Tomcat]]

verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b3pre) Gecko/2008011009 Firefox/3.0b3pre ID:2008011009 with the testcase from jesse.

Comment 5

[Jesse Ruderman]

I don't see any assertions on branch, so I'm making this bug report public.

Comment 6

[Jesse Ruderman]

Crashtest checked in.