"ASSERTION: Weird break found" with rtl, -moz-column

RESOLVED FIXED in Firefox 7

Status

()

Core
Layout: Text
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Assigned: smontagu)

Tracking

(Blocks: 2 bugs, {assertion, regression, testcase})

7 Branch
mozilla7
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox6 unaffected, firefox7 fixed, status1.9.2 unaffected)

Details

(Whiteboard: [qa-])

Attachments

(3 attachments)

(Reporter)

Description

6 years ago
Created attachment 538725 [details]
testcase

###!!! ASSERTION: Weird break found!: 'limitLength >= 0', file layout/generic/nsTextFrameThebes.cpp, line 6824

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file gfx/thebes/gfxSkipChars.cpp, line 92

###!!! ASSERTION: negative length: 'GetContentEnd() - mContentOffset >= 0', file layout/generic/nsTextFrame.h, line 327

###!!! ASSERTION: integer overflow: 'mMaxTextLength < PR_UINT32_MAX - aFrame->GetContentLength()', file layout/generic/nsTextFrameThebes.cpp, line 1437

Regression from bug 263359, I think.
(Reporter)

Comment 1

6 years ago
Created attachment 538726 [details]
stack traces
(Assignee)

Updated

6 years ago
Assignee: nobody → smontagu
Security regression from something landed for Firefox 7, should be tracked.
tracking-firefox7: --- → ?
(Assignee)

Comment 3

6 years ago
Created attachment 539148 [details] [diff] [review]
Patch

This came from not checking the definition of which characters constitute a forced line break in CSS.
Attachment #539148 - Flags: review?(roc)
(Reporter)

Comment 4

6 years ago
As assertion from a spec violation? Is that because other parts of Gecko check the right thing?
(Assignee)

Comment 5

6 years ago
Yes, the assertion was caused by the inconsistency between nsBidiPresUtils and nsTextFrameThebes.
Comment on attachment 539148 [details] [diff] [review]
Patch

Review of attachment 539148 [details] [diff] [review]:
-----------------------------------------------------------------
Attachment #539148 - Flags: review?(roc) → review+
(Assignee)

Comment 7

6 years ago
http://hg.mozilla.org/mozilla-central/rev/bb5bd25d0788
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite+
Resolution: --- → FIXED

Updated

6 years ago
tracking-firefox7: ? → ---
Since we never shipped a release with this bug we don't need to keep it hidden.
Group: core-security
status1.9.2: --- → unaffected
status-firefox6: --- → unaffected
status-firefox7: --- → fixed
Keywords: regression
Target Milestone: --- → mozilla7
Version: Trunk → 7 Branch
Mozilla/5.0 (X11; Linux x86_64; rv:7.0) Gecko/20100101 Firefox/7.0

Could you provide some clear steps to reproduce in order to verify this issue on QA side?
(Reporter)

Comment 10

6 years ago
Virgil - just load the testcase in a build with assertions enabled (i.e. a debug build).
qa- as no QA fix verification needed
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.