Closed Bug 679459 Opened 9 years ago Closed 9 years ago

"ASSERTION: mEndOffset is beyond the end of this node" in nsRange::ContentInserted

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla9

People

(Reporter: jruderman, Assigned: mats)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase)

Attachments

(4 files, 1 obsolete file)

Attached file testcase
###!!! ASSERTION: mEndOffset is beyond the end of this node: 'static_cast<PRUint32>(mEndOffset) <= aInfo->mChangeEnd', file content/base/src/nsRange.cpp, line 305
Attached file stack trace
I added this assertion in bug 191864.  I'll investigate...
Assignee: nobody → matspal
Blocks: 191864
OS: Mac OS X → All
Hardware: x86_64 → All
Blocks: 682463
No longer blocks: 682463
Keywords: regression
Attached patch fixSplinter Review
The problem is that nsRange::CutContents uses SplitData internally
in a different way than splitText, in some case it removes the
new node:
http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsRange.cpp#1395

Calling SetTextInternal with NULL in that case makes us use the old
path in nsRange::CharacterDataChanged that doesn't try to change the
boundary point.
Attachment #558235 - Flags: review?(Olli.Pettay)
Attached patch regression test (obsolete) — Splinter Review
Attachment #558235 - Flags: review?(Olli.Pettay) → review+
Attached patch regression testSplinter Review
Attachment #558236 - Attachment is obsolete: true
http://hg.mozilla.org/mozilla-central/rev/077597e9accd
http://hg.mozilla.org/mozilla-central/rev/ed1946447c5e
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: [inbound]
Component: DOM: Traversal-Range → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.