Closed Bug 663662 Opened 10 years ago Closed 10 years ago

"ASSERTION: Weird break found" with rtl, -moz-column

Categories

(Core :: Layout: Text and Fonts, defect)

7 Branch
x86_64
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla7
Tracking Status
firefox6 --- unaffected
firefox7 --- fixed
status1.9.2 --- unaffected

People

(Reporter: jruderman, Assigned: smontagu)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [qa-])

Attachments

(3 files)

Attached file testcase
###!!! ASSERTION: Weird break found!: 'limitLength >= 0', file layout/generic/nsTextFrameThebes.cpp, line 6824

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file gfx/thebes/gfxSkipChars.cpp, line 92

###!!! ASSERTION: negative length: 'GetContentEnd() - mContentOffset >= 0', file layout/generic/nsTextFrame.h, line 327

###!!! ASSERTION: integer overflow: 'mMaxTextLength < PR_UINT32_MAX - aFrame->GetContentLength()', file layout/generic/nsTextFrameThebes.cpp, line 1437

Regression from bug 263359, I think.
Attached file stack traces
Assignee: nobody → smontagu
Security regression from something landed for Firefox 7, should be tracked.
Attached patch PatchSplinter Review
This came from not checking the definition of which characters constitute a forced line break in CSS.
Attachment #539148 - Flags: review?(roc)
As assertion from a spec violation? Is that because other parts of Gecko check the right thing?
Yes, the assertion was caused by the inconsistency between nsBidiPresUtils and nsTextFrameThebes.
Comment on attachment 539148 [details] [diff] [review]
Patch

Review of attachment 539148 [details] [diff] [review]:
-----------------------------------------------------------------
Attachment #539148 - Flags: review?(roc) → review+
http://hg.mozilla.org/mozilla-central/rev/bb5bd25d0788
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Since we never shipped a release with this bug we don't need to keep it hidden.
Group: core-security
Keywords: regression
Target Milestone: --- → mozilla7
Version: Trunk → 7 Branch
Mozilla/5.0 (X11; Linux x86_64; rv:7.0) Gecko/20100101 Firefox/7.0

Could you provide some clear steps to reproduce in order to verify this issue on QA side?
Virgil - just load the testcase in a build with assertions enabled (i.e. a debug build).
qa- as no QA fix verification needed
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.