Closed Bug 415818 Opened 13 years ago Closed 12 years ago

"ASSERTION: bad index", "ASSERTION: negative length" with MathML rquote attribute

Categories

(Core :: MathML, defect, P3)

x86
macOS
defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

247 bytes, application/xhtml+xml
Details
Attached file testcase
Loading the testcase triggers these four assertions:

###!!! ASSERTION: bad index: 'PRUint32(aIndex) < mState.mLength', file /Users/jruderman/trunk/mozilla/layout/base/../../content/base/src/nsTextFragment.h, line 184

###!!! ASSERTION: negative length: 'GetContentEnd() - mContentOffset >= 0', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextFrame.h, line 291

###!!! ASSERTION: integer overflow: 'mMaxTextLength <= mMaxTextLength + aFrame->GetContentLength()', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp, line 1081

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
Flags: blocking1.9?
Flags: blocking1.9? → blocking1.9+
Priority: -- → P3
Flags: wanted-next+
Flags: blocking1.9-
Flags: tracking1.9+
WFM, Mac trunk debug.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Flags: in-testsuite?
Group: core-security → core-security-release
Group: core-security-release
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.