395335 - Changing text in <xul:tree> triggers "ASSERTION: Invalid offset"

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect)

Description

[Jesse Ruderman]

Reloading the testcase triggers:

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
###!!! ASSERTION: Substring out of range: 'aStart + aLength <= mCharacterCount', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxFont.cpp, line 1045

Also, the display is incorrect.  Firefox should display the new text 'xyz' but instead it continues to display the old text 'a'.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Jesse Ruderman]

Attachment: reference

Comment 3

[[e-mail]]

(In reply to comment #0)
>Also, the display is incorrect.  Firefox should display the new text 'xyz' but
>instead it continues to display the old text 'a'.
Actually, it shouldn't display either text; at least, older builds don't.

Comment 4

[Jesse Ruderman]

How long ago did Firefox start displaying the text?

Comment 5

[[e-mail]]

I don't have any builds in between, but 20070619 doesn't display the text.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This works for me on Mac. We display the text and don't assert. Anyone confirm?

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

WFM on Linux, no assert and text is displayed.

Comment 8

[Jesse Ruderman]

WFM.  Should I check in the files here as a reftest pair?

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I think we should probably just check in the testcase as a "crash/assert/leak test" when the work in bug 399830 is done.

Comment 10

[Jesse Ruderman]

Crashtest checked in.