Last Comment Bug 679459 - "ASSERTION: mEndOffset is beyond the end of this node" in nsRange::ContentInserted
: "ASSERTION: mEndOffset is beyond the end of this node" in nsRange::ContentIns...
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: DOM: Core & HTML (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla9
Assigned To: Mats Palmgren (:mats)
:
Mentors:
Depends on:
Blocks: 336383 191864
  Show dependency treegraph
 
Reported: 2011-08-16 12:22 PDT by Jesse Ruderman
Modified: 2013-04-04 13:53 PDT (History)
5 users (show)
mats: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (322 bytes, text/html)
2011-08-16 12:22 PDT, Jesse Ruderman
no flags Details
stack trace (3.18 KB, text/plain)
2011-08-16 12:23 PDT, Jesse Ruderman
no flags Details
fix (1008 bytes, patch)
2011-09-04 23:36 PDT, Mats Palmgren (:mats)
bugs: review+
Details | Diff | Review
regression test (1011 bytes, patch)
2011-09-04 23:37 PDT, Mats Palmgren (:mats)
no flags Details | Diff | Review
regression test (1.07 KB, patch)
2011-09-08 01:51 PDT, Mats Palmgren (:mats)
no flags Details | Diff | Review

Description Jesse Ruderman 2011-08-16 12:22:32 PDT
Created attachment 553549 [details]
testcase

###!!! ASSERTION: mEndOffset is beyond the end of this node: 'static_cast<PRUint32>(mEndOffset) <= aInfo->mChangeEnd', file content/base/src/nsRange.cpp, line 305
Comment 1 Jesse Ruderman 2011-08-16 12:23:01 PDT
Created attachment 553551 [details]
stack trace
Comment 2 Mats Palmgren (:mats) 2011-08-16 12:57:10 PDT
I added this assertion in bug 191864.  I'll investigate...
Comment 3 Mats Palmgren (:mats) 2011-09-04 23:36:30 PDT
Created attachment 558235 [details] [diff] [review]
fix

The problem is that nsRange::CutContents uses SplitData internally
in a different way than splitText, in some case it removes the
new node:
http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsRange.cpp#1395

Calling SetTextInternal with NULL in that case makes us use the old
path in nsRange::CharacterDataChanged that doesn't try to change the
boundary point.
Comment 4 Mats Palmgren (:mats) 2011-09-04 23:37:13 PDT
Created attachment 558236 [details] [diff] [review]
regression test
Comment 5 Mats Palmgren (:mats) 2011-09-08 01:51:00 PDT
Created attachment 559078 [details] [diff] [review]
regression test

Note You need to log in before you can comment on or make changes to this bug.