Closed Bug 700090 Opened 8 years ago Closed 8 years ago

"ASSERTION: mEndOffset is beyond the end of this node" with MathML

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla11

People

(Reporter: jruderman, Assigned: mats)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file testcase
###!!! ASSERTION: mEndOffset is beyond the end of this node: 'static_cast<PRUint32>(mEndOffset) <= aInfo->mChangeEnd', file content/base/src/nsRange.cpp, line 317
Attached file stack trace
Attached patch fixSplinter Review
The assertion is slightly wrong, it should allow the range offset to be
length + 1.  Same problem with the mStartOffset assertion.
Assignee: nobody → matspal
Attachment #572272 - Flags: review?(bugs)
Comment on attachment 572272 [details] [diff] [review]
fix

Ah, range offsets can point to after the last character.
Took some time to figure out...
Attachment #572272 - Flags: review?(bugs) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/532f0a13b485
Flags: in-testsuite+
OS: Mac OS X → All
Hardware: x86_64 → All
Whiteboard: [inbound]
Target Milestone: --- → mozilla11
https://hg.mozilla.org/mozilla-central/rev/532f0a13b485
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Whiteboard: [inbound]
Component: DOM: Traversal-Range → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.