431087 - ###!!! ASSERTION: prevent array boundary violation: 'colIndex < mNumCols'

Status: RESOLVED FIXED

(Core :: Layout: Tables, defect)

Description

[Mats Palmgren (inactive)]

The testcase in bug 430814 triggers the following assertions:

###!!! ASSERTION: no common ancestor at all???: 'parent', file mozilla/layout/base/nsLayoutUtils.cpp, line 377
###!!! ASSERTION: no common ancestor at all???: 'parent', file mozilla/layout/base/nsLayoutUtils.cpp, line 377
###!!! ASSERTION: prevent array boundary violation: 'colIndex < mNumCols', file mozilla/layout/tables/nsTablePainter.cpp, line 616

Comment 1

[Bernd]

All your bugs belong to me

Comment 2

[Jesse Ruderman]

When I print the testcase, I get

###!!! ASSERTION: CreateRenderingContext failure: 'Not Reached', file /Users/jruderman/trunk/mozilla/layout/base/nsPresShell.cpp, line 6236

plus the assertions in comment 0.

Comment 3

[Daniel Veditz [:dveditz]]

This was spun out of a security bug, and the assertion kind of screams "hack me here".

Nominating for blocking 1.9 because this was originally a public bug -- did it get spotted?

Comment 4

[Damon Sicore (:damons)]

Do we think we can have a fix for this quickly?

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I think the assertion is saying that we are hitting the extra check (added in bug 430814) that prevents us from going past the end of the array, not that we are actually going past the end of the array.

Thus I think that the bug made sense in its original state -- public, and not nominated for blocking1.9.  But Mats/Bernd should confirm that.

Comment 6

[Mats Palmgren (inactive)]

Correct.

Comment 8

[Bernd]

option 1 is bug  424377 

Comment 9

[Mike Beltzner [:beltzner, not reading bugmail]]

Not going to block the final release on this, and based on what happened with bug 424377, I think we want to play whack-a-mole :(

Comment 10

[Daniel Veditz [:dveditz]]

(In reply to comment #5)
> the assertion is saying that we are hitting the extra check [...],
> not that we are actually going past the end of the array.

Maybe an NS_WARNING() would appear less alarming in that case then.

> Thus I think that the bug made sense in its original state -- public, and not
> nominated for blocking1.9

Sounds good, thanks for clarifying.

Comment 11

[Bernd]

The nextinflow idea does not fly the additional table cells are copies but not nextinflows. So I will leave this like it is.
 

Comment 12

[Bernd]

I do not see the point of 1.9.0+ing this. The workaround that I thought about does not work. I don't see a another option than  bug 424377.

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

Can't reproduce after bug 425265.