"ASSERTION: running past end" with -moz-column, pre-wrap, inline-block

RESOLVED FIXED in mozilla1.9.1b2

Status

()

Core
Layout
--
critical
RESOLVED FIXED
10 years ago
9 years ago

People

(Reporter: Jesse Ruderman, Assigned: mats)

Tracking

(Blocks: 2 bugs, {assertion, testcase, verified1.9.0.4})

Trunk
mozilla1.9.1b2
assertion, testcase, verified1.9.0.4
Points:
---
Dependency tree / graph
Bug Flags:
wanted1.9.1 +
wanted1.9.0.x +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical?])

Attachments

(3 attachments)

(Reporter)

Description

10 years ago
Created attachment 328078 [details]
testcase (may cause heap corruption)

Loading the testcase triggers:

###!!! ASSERTION: Shouldn't be incomplete if availableHeight is UNCONSTRAINED.: 'aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file mozilla/layout/generic/nsBlockFrame.cpp, line 1411

###!!! ASSERTION: running past end: 'mCurrent != mListLink', file mozilla/layout/base/../generic/nsLineBox.h, line 611

The second assertion is usually followed by heap corruption, so I'm filing this bug as security sensitive.  I have it set to abort locally.
(Reporter)

Updated

10 years ago
Whiteboard: [sg:critical?]
(Reporter)

Updated

10 years ago
Flags: blocking1.9.1?
Flags: blocking1.9.1? → wanted1.9.1+
(Assignee)

Comment 1

9 years ago
Created attachment 342011 [details] [diff] [review]
Patch rev. 1

The line that we pass to MarkLineDirty() is an overflow line so
the test "mLines.front()" before using "aLine.prev()" is testing
the wrong line list.  That is the cause of the crash.

I also think the frame could be different from 'this' so we should
use GetContainer(), (or should we just assert GetContainer()==this ?).
Assignee: nobody → mats.palmgren
Attachment #342011 - Flags: superreview?(roc)
Attachment #342011 - Flags: review?(roc)
(Assignee)

Updated

9 years ago
OS: Mac OS X → All
Hardware: PC → All
(Assignee)

Updated

9 years ago
Blocks: 446181
(Assignee)

Updated

9 years ago
Blocks: 445288
(Assignee)

Updated

9 years ago
Blocks: 403600
Attachment #342011 - Flags: superreview?(roc)
Attachment #342011 - Flags: superreview+
Attachment #342011 - Flags: review?(roc)
Attachment #342011 - Flags: review+
Flags: wanted1.9.0.x+
(Assignee)

Comment 2

9 years ago
Created attachment 342747 [details] [diff] [review]
crashtest.diff
(Assignee)

Comment 3

9 years ago
http://hg.mozilla.org/mozilla-central/rev/12083acc3286

Holding the crashtest until 1.9.0.x is released with a fix.

Filed bug 459597 on the "Shouldn't be incomplete" assertion.

-> FIXED
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
(Assignee)

Updated

9 years ago
Target Milestone: --- → mozilla1.9.1b2
(Assignee)

Updated

9 years ago
Attachment #342011 - Flags: approval1.9.0.4?
Attachment #342011 - Flags: approval1.9.0.4? → approval1.9.0.4+
Comment on attachment 342011 [details] [diff] [review]
Patch rev. 1

Approved for 1.9.0.4, a=dveditz for release-drivers
(Assignee)

Comment 5

9 years ago
Landed on CVS trunk for 1.9.0.4:
mozilla/layout/generic/nsBlockFrame.cpp  3.959
mozilla/layout/generic/nsBlockFrame.h    3.273
Keywords: fixed1.9.0.4
Tomcat, can you verify that this assertion is gone with your nightly debug 1.9.0 build?
Verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.4pre) Gecko/2008102800 Firefox/3.0.4pre and the Testcase from Mats. I see not the Assertion -> ASSERTION: running past end" with -moz-column..., so verified 1.9.0.4

But i still see 
###!!! ASSERTION: Shouldn't be incomplete if availableHeight is UNCONSTRAINED.: 'aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file /work/mozilla/builds/1.9.0/mozilla/layout/generic/nsBlockFrame.cpp, line 1405 - but this is covered in Bug 459597
Keywords: fixed1.9.0.4 → verified1.9.0.4
Group: core-security
(Reporter)

Updated

9 years ago
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.