395556 - "ASSERTION: colgroup data should not be null" with large columnspan and strangely nested table elements

Status: RESOLVED WORKSFORME

(Core :: MathML, defect)

Description

[Jesse Ruderman]

Attachment: simple testcase without any scripts

Loading the testcase triggers:

###!!! ASSERTION: colgroup data should not be null - bug 237421: 'mCols[i].mColGroup', file /Users/jruderman/trunk/mozilla/layout/tables/nsTablePainter.cpp, line 257

Comment 1

[Jesse Ruderman]

Attachment: testcase that demonstrates a "doubling" effect (may hang Firefox)

Even though the columnspan in the markup is much smaller, this testcase eventually (~15 seconds) triggers the assertion simply by adding <style> elements that don't do anything to the document.

I found the bug because of this phenomenon.

Comment 2

[Daniel Holbert [:dholbert] (PTO until 2/24)]

It looks like this is due to an overflow of a 16-bit value somewhere.

Modifying the first simple testcase, I get this behavior:
   columnspan="65536" (2^16) or any lower value: No bug. (no colgroup assertion)
   columnspan="65537" (2^16 + 1) or any higher value: *BUG* (colgroup assertion)

Comment 3

[Bernd]

 <math:mtd columnspan="72205">

somebody is sneaking trough the large colspan protection see 
http://lxr.mozilla.org/seamonkey/source/content/html/content/src/nsHTMLTableCellElement.cpp#265

We need to do the same for the mtd otherwise insane colspan values are easily used as DOS attacks against FF.

Comment 4

[Jesse Ruderman]

WFM.  Probably fixed by bug 443089.