Closed Bug 406675 Opened 15 years ago Closed 15 years ago
"ASSERTION: bad index" in ns
Text Fragment .h with RLE
Loading the testcase triggers: ###!!! ASSERTION: bad index: 'PRUint32(aIndex) < mState.mLength', file /Users/jruderman/trunk/mozilla/layout/base/../../content/base/src/nsTextFragment.h, line 184 Filing as security-sensitive because previous bugs involving this assertion were [sg:moderate]. (Bug 368860 and bug 385426.)
Assignee: nobody → smontagu
OS: Mac OS X → All
Hardware: PC → All
Comment on attachment 291753 [details] [diff] [review] Do AdjustOffsetsForBidi on the original frame before creating a bidi continuation +DIRS += reftests + I don't think you want this here.
Sorry, I didn't save changes to the patch before attaching it. I also meant to ask review from Uri, but the request failed because he wasn't cc-ed
Comment on attachment 291762 [details] [diff] [review] The correct patch transferring sr=roc
Comment on attachment 291762 [details] [diff] [review] The correct patch Looks OK to me. sorry for the delay.
Attachment #291762 - Flags: review?(uriber) → review+
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
No assertions on the 1.8 branch.
Crashtest checked in.
Flags: in-testsuite? → in-testsuite+
Component: Layout: BiDi Hebrew & Arabic → Layout: Text
QA Contact: layout.bidi → layout.fonts-and-text
You need to log in before you can comment on or make changes to this bug.