483346 - Assertions/crashes with <input type=image>, rtl, wrapping

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase 1: "bad index" assertion and crash

I can't get this to do anything other than dereference null, but it has a bad vibe, so I'm filing it as security-sensitive.

###!!! ASSERTION: bad index: 'PRUint32(aIndex) < mState.mLength', file /Users/jruderman/central/layout/base/../../content/base/src/nsTextFragment.h, line 186

Crash [@ nsTextFragment::CharAt]

Comment 1

[Jesse Ruderman]

Attachment: testcase 2: "SetMayHaveFrame failed" assertion

###!!! ASSERTION: SetMayHaveFrame failed?: 'mContent->MayHaveFrame()', file /Users/jruderman/central/layout/generic/nsFrame.cpp, line 393

Comment 2

[Simon Montagu :smontagu]

The root of the problems here seems to be that after deleteContents, GetContentOffset and GetContentLength lie.

Comment 3

[Timothy Nikkel (:tnikkel)]

I don't get any assertions or crashes with a recent Linux debug build on either testcase.

Comment 4

[Jesse Ruderman]

WFM on Mac, too.  (Tested using post-1.9.2-branch mozilla-central.)