"ASSERTION: Doing nscoord addition with values > nscoord_MAX" with inline-block, percentage margin

RESOLVED FIXED

Status

()

RESOLVED FIXED
12 years ago
11 years ago

People

(Reporter: jruderman, Assigned: dholbert)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
All
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

12 years ago
Created attachment 283043 [details]
testcase

Loading the testcase triggers lots of assertions, starting with:

###!!! ASSERTION: Doing nscoord addition with values > nscoord_MAX: 'a < nscoord_MAX && b < nscoord_MAX', file ../../dist/include/gfx/nsCoord.h, line 151

###!!! ASSERTION: nscoord addition will reach or pass nscoord_MAX: '(PRInt64)a + (PRInt64)b < (PRInt64)nscoord_MAX', file ../../dist/include/gfx/nsCoord.h, line 153
(Assignee)

Comment 1

12 years ago
Created attachment 283069 [details] [diff] [review]
fix (trivial)

Adding NSCoordSaturatingAdd call in nsTextFrameThebes.cpp fixes first assertion.

Adding NSCoordSaturatingSubtract call in nsFrame.cpp fixes second assertion.

(The only other change -- the added NSCoordSaturatingAdd call in nsFrame.cpp -- doesn't actually affect this bug's testcase.  The change is preventative, because currentLine could be nscoord_MAX there, and we shouldn't add directly to it.)
Attachment #283069 - Flags: review?(dbaron)
Attachment #283069 - Flags: approval1.9?
(Assignee)

Comment 2

12 years ago
Created attachment 283073 [details]
testcase2 (using float)

Per jesse's suggestion, I made this testcase that depends on the preemptive change in this bug's fix.  (which was mentioned parenthetically in my last comment, at nsFrame.cpp:2869:
 -    currentLine += floats_done;
 +    currentLine = NSCoordSaturatingAdd(currentLine, floats_done);

After applying my patch's other two changes, but skipping the preemptive change, I get these assertions when loading testcase2:

  ###!!! ASSERTION: Doing nscoord subtraction with values > nscoord_MAX: 'a < nscoord_MAX && b < nscoord_MAX', file ../../dist/include/gfx/nsCoord.h, line 208
  ###!!! ASSERTION: nscoord subtraction will reach or pass nscoord_MAX: '(PRInt64)a - (PRInt64)b < (PRInt64)nscoord_MAX', file ../../dist/include/gfx/nsCoord.h, line 210

(I think we're hitting these in the added call to NSCoordSaturatingSubtract at nsFrame.cpp:2874)

After adding the third change, those assertions go away.
(Assignee)

Updated

12 years ago
Status: NEW → ASSIGNED
(Assignee)

Updated

12 years ago
Assignee: nobody → dholbert
Status: ASSIGNED → NEW
(Assignee)

Updated

12 years ago
Status: NEW → ASSIGNED
OS: Mac OS X → All
Attachment #283069 - Flags: superreview+
Attachment #283069 - Flags: review?(dbaron)
Attachment #283069 - Flags: review+
Attachment #283069 - Flags: approval1.9?
Attachment #283069 - Flags: approval1.9+
(Assignee)

Comment 3

11 years ago
Checking in nsTextFrameThebes.cpp;
/cvsroot/mozilla/layout/generic/nsTextFrameThebes.cpp,v  <--  nsTextFrameThebes.cpp
new revision: 3.128; previous revision: 3.127
done
Checking in nsFrame.cpp;
/cvsroot/mozilla/layout/generic/nsFrame.cpp,v  <--  nsFrame.cpp
new revision: 3.766; previous revision: 3.765
done
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
(Reporter)

Comment 4

11 years ago
Crashtests checked in.
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.