The default bug view has changed. See this FAQ.

"ASSERTION: invalid array index" with overflow:scroll, float:left, text-transform, changing <style>

RESOLVED FIXED

Status

()

Core
Layout
P2
normal
RESOLVED FIXED
8 years ago
7 years ago

People

(Reporter: Jesse Ruderman, Assigned: roc)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
x86
Mac OS X
assertion, testcase, verified1.9.1, verified1.9.2
Points:
---
Bug Flags:
blocking1.9.0.19 -
wanted1.9.0.x +
in-testsuite +

Firefox Tracking Flags

(blocking2.0 final+, status1.9.2 .2-fixed, status1.9.1 .9-fixed)

Details

(Whiteboard: [sg:critical?])

Attachments

(3 attachments)

(Reporter)

Description

8 years ago
Created attachment 384546 [details]
testcase

###!!! ASSERTION: Should have been cleared: 'mBreakSinks.IsEmpty()', file layout/generic/nsTextFrameThebes.cpp, line 648

###!!! ASSERTION: Should have Reset() before destruction!: 'mCurrentWord.Length() == 0', file content/base/src/nsLineBreaker.cpp, line 51

###!!! ASSERTION: invalid array index: 'i < Length()', file nsTArray.h, line 317

###!!! ASSERTION: Hmm, something went wrong, aOffset should have been found: 'mGlyphRuns[start].mCharacterOffset <= aOffset', file gfx/thebes/src/gfxFont.cpp, line 2189

Security-sensitive because the "invalid array index" assertion is in an unchecked array access function.
(Reporter)

Updated

8 years ago
Whiteboard: [sg:critical?]
Assignee: nobody → roc
blocking2.0: --- → ?
Created attachment 428646 [details] [diff] [review]
fix

We need to flush out break sinks etc even if there are no mapped flows. In this testcase, the textrun finishes after the T (since it's in a float by itself) so we exit too early from FlushFrames. Flushing out the break sinks is needed so that we tell the text-transform textrun where the capitalized characters are.
Attachment #428646 - Flags: review?(smontagu)
Whiteboard: [sg:critical?] → [sg:critical?][needs review]
Created attachment 428648 [details]
simpler testcase

This testcase is simpler but still fires the first assertion.
Attachment #428646 - Flags: review?(smontagu) → review+
Whiteboard: [sg:critical?][needs review] → [sg:critical?][needs landing]
http://hg.mozilla.org/mozilla-central/rev/9c24556c14c3

I checked in my simple testcase, which doesn't lead directly to a security issue.
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Whiteboard: [sg:critical?][needs landing] → [sg:critical?]
Comment on attachment 428646 [details] [diff] [review]
fix

Patch should apply to all 1.9.x branches.
Attachment #428646 - Flags: approval1.9.2.2?
Attachment #428646 - Flags: approval1.9.1.9?
Attachment #428646 - Flags: approval1.9.0.19?
Comment on attachment 428646 [details] [diff] [review]
fix

a=beltzner for all branches
Attachment #428646 - Flags: approval1.9.2.2?
Attachment #428646 - Flags: approval1.9.2.2+
Attachment #428646 - Flags: approval1.9.1.9?
Attachment #428646 - Flags: approval1.9.1.9+
Attachment #428646 - Flags: approval1.9.0.19?
Attachment #428646 - Flags: approval1.9.0.19+
Whiteboard: [sg:critical?] → [sg:critical?][needs 190 landing][needs 191 landing][needs 192 landing]

Comment 6

7 years ago
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/60dce6cf3aaa
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/5d3418e69ab0
status1.9.1: --- → .9-fixed
status1.9.2: --- → .2-fixed
Checked into 1.9.0.
Keywords: fixed1.9.0.19
Whiteboard: [sg:critical?][needs 190 landing][needs 191 landing][needs 192 landing] → [sg:critical?]
I backed this out of 1.9.0 because it caused crashes there. Is it worth figuring those out, or should we just leave this unfixed on 1.9.0?
Keywords: fixed1.9.0.19
Comment on attachment 428646 [details] [diff] [review]
fix

I'm fine to leave these unfixed, yeah. It does mean we can't open up this bug for a while longer, though.
Attachment #428646 - Flags: approval1.9.0.19+ → approval1.9.0.19-
Verified for 1.9.1 with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.9pre) Gecko/20100311 Shiretoko/3.5.9pre (.NET CLR 3.5.30729) using testcase.

Verified for 1.9.2 with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3pre) Gecko/20100315 Namoroka/3.6.3pre (.NET CLR 3.5.30729). (This was built just after the release branch was cut but before any checkins were made so it is the same as 1.9.2.2.)
Keywords: verified1.9.1, verified1.9.2
Flags: wanted1.9.0.x+
Flags: blocking1.9.0.19-
blocking2.0: ? → final+
Priority: -- → P2
Group: core-security
You need to log in before you can comment on or make changes to this bug.