393760 - "ASSERTION: nsVoidArray::ElementAt: index out of range" with mfenced, mathbackground

Status: RESOLVED FIXED

(Core :: MathML, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: nsVoidArray::ElementAt: index out of range: '0 <= aIndex && aIndex < Count()', file ../../../dist/include/xpcom/nsVoidArray.h, line 81

There's also a visual glitch: instead of a pair of parentheses with a yellow background, I see a *random unicode character* with a white background.  It's different on every load, suggesting an uninitialized variable or an OOB read.  (nsVoidArray::ElementAt has a runtime check, so if there's an OOB read, it's somewhere else.)

Comment 1

[Jesse Ruderman]

Attachment: reference

The same DOM, but static, makes a nice reference (for reftest).

Comment 2

[Jesse Ruderman]

Attachment: stack trace for the assertion

Generated with:
  export XPCOM_DEBUG_BREAK=stack
  (run firefox)
  (copy sketchy assertion stack to clipboard)
  pbpaste | mac2unix | ~/trunk/mozilla/tools/rb/fix-macosx-stack.pl

Comment 3

[Karl Tomlinson (:karlt)]

Reproducing on Linux as well as Mac:

WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x805303E8: file /home/karl/moz/mozilla/layout/style/nsCSSStyleSheet.cpp, line 1520
###!!! ASSERTION: nsVoidArray::ElementAt: index out of range: '0 <= aIndex && aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, line 81
WARNING: String ending in half a surrogate pair!: file ../../../dist/include/string/nsUTF8Utils.h, line 748

Comment 4

[Jesse Ruderman]

No longer asserts for me on trunk (Mac).  Apparently we no longer honor the mathbackground attribute on <mfenced> elements.  This brings us more in line with the MathML spec, which specifies mathbackground as being an attribute of <mstyle> and tokens only.  I'm guessing this change was intentional and part of bug 355548.

Doesn't assert for me on branch.

Comment 5

[Jesse Ruderman]

roc, should I add this testcase as a crashtest, or should I make reftests to test that we support mathbackground on the correct elements but not on mfenced?

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

you could do both :-)

Comment 7

[Jesse Ruderman]

Attachment: reftests

Ok, I checked in a crashtest, and here's some reftests.

Comment 8

[Jesse Ruderman]

Old builds fail almost every line of 393760-1.xml ;)

Comment 9

[Jesse Ruderman]

Reftests checked in too.

Comment 10

[Jesse Ruderman]

I had to remove the first line from the first reftest because the span's height was more than the math's height on a Linux Tinderbox.

Comment 11

[Armen [:armenzg]]

This reftest is failing for Fedora unit tests (see bug 560882).
I have machines available to help fixing it.
Let me know if it should make sense to file another bug instead of reopening this one.

Comment 12

[Jesse Ruderman]

Armen, please file a new bug (blocking this one if you want).  We usually don't reopen bugs except for backouts or patches that didn't fix the bug as reported.