If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

"ASSERTION: invalid array index" with DOMSVGLengthList.removeItem

RESOLVED INCOMPLETE

Status

()

Core
SVG
--
critical
RESOLVED INCOMPLETE
7 years ago
7 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 1 bug, {assertion})

Trunk
x86
Mac OS X
assertion
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
Created attachment 500719 [details]
stack trace

Hit this with crossfuzz, don't know how to reproduce.

###!!! ASSERTION: invalid array index: 'i < Length()', file nsTArray.h, line 451

Comment 1

7 years ago
Does this still happen? I suspect jwatt's fixes to LengthList should have sorted this.
(Reporter)

Updated

7 years ago
Status: UNCONFIRMED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.