"ASSERTION: mEndOffset is beyond the end of this node" with MathML

RESOLVED FIXED in mozilla11

Status

()

Core
DOM: Core & HTML
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: Jesse Ruderman, Assigned: mats)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla11
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

6 years ago
Created attachment 572262 [details]
testcase

###!!! ASSERTION: mEndOffset is beyond the end of this node: 'static_cast<PRUint32>(mEndOffset) <= aInfo->mChangeEnd', file content/base/src/nsRange.cpp, line 317
(Reporter)

Comment 1

6 years ago
Created attachment 572263 [details]
stack trace
(Assignee)

Comment 2

6 years ago
Created attachment 572272 [details] [diff] [review]
fix

The assertion is slightly wrong, it should allow the range offset to be
length + 1.  Same problem with the mStartOffset assertion.
Assignee: nobody → matspal
Attachment #572272 - Flags: review?(bugs)

Comment 3

6 years ago
Comment on attachment 572272 [details] [diff] [review]
fix

Ah, range offsets can point to after the last character.
Took some time to figure out...
Attachment #572272 - Flags: review?(bugs) → review+
(Assignee)

Comment 4

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/532f0a13b485
Flags: in-testsuite+
OS: Mac OS X → All
Hardware: x86_64 → All
Whiteboard: [inbound]
Target Milestone: --- → mozilla11
https://hg.mozilla.org/mozilla-central/rev/532f0a13b485
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Whiteboard: [inbound]
Component: DOM: Traversal-Range → DOM: Core & HTML
Product: Core → Core
You need to log in before you can comment on or make changes to this bug.