Last Comment Bug 700090 - "ASSERTION: mEndOffset is beyond the end of this node" with MathML
: "ASSERTION: mEndOffset is beyond the end of this node" with MathML
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: DOM: Core & HTML (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla11
Assigned To: Mats Palmgren (:mats)
:
Mentors:
Depends on:
Blocks: 336383
  Show dependency treegraph
 
Reported: 2011-11-05 23:17 PDT by Jesse Ruderman
Modified: 2013-04-04 13:53 PDT (History)
3 users (show)
mats: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (575 bytes, text/html)
2011-11-05 23:17 PDT, Jesse Ruderman
no flags Details
stack trace (2.62 KB, text/plain)
2011-11-05 23:22 PDT, Jesse Ruderman
no flags Details
fix (4.44 KB, patch)
2011-11-06 01:15 PDT, Mats Palmgren (:mats)
bugs: review+
Details | Diff | Review

Description Jesse Ruderman 2011-11-05 23:17:59 PDT
Created attachment 572262 [details]
testcase

###!!! ASSERTION: mEndOffset is beyond the end of this node: 'static_cast<PRUint32>(mEndOffset) <= aInfo->mChangeEnd', file content/base/src/nsRange.cpp, line 317
Comment 1 Jesse Ruderman 2011-11-05 23:22:09 PDT
Created attachment 572263 [details]
stack trace
Comment 2 Mats Palmgren (:mats) 2011-11-06 01:15:19 PDT
Created attachment 572272 [details] [diff] [review]
fix

The assertion is slightly wrong, it should allow the range offset to be
length + 1.  Same problem with the mStartOffset assertion.
Comment 3 Olli Pettay [:smaug] (high review load, please consider other reviewers) 2011-11-06 08:29:04 PST
Comment on attachment 572272 [details] [diff] [review]
fix

Ah, range offsets can point to after the last character.
Took some time to figure out...
Comment 5 Marco Bonardo [::mak] 2011-11-10 03:08:02 PST
https://hg.mozilla.org/mozilla-central/rev/532f0a13b485

Note You need to log in before you can comment on or make changes to this bug.