Closed Bug 784905 Opened 8 years ago Closed 8 years ago
"Assertion failure: uint32
_t(start Offset) <= start Parent->Length() && uint32 _t(end Offset) <= end Parent->Length()"
Assertion failure: uint32_t(startOffset) <= startParent->Length() && uint32_t(endOffset) <= endParent->Length(), at content/base/src/nsContentIterator.cpp:1203 This assertion was added in bug 767169, so maybe it's related to bug 772387. But this isn't the first problem caused by MathML-layout's habit of modifying the DOM.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: CVE-2012-4180
You need to log in before you can comment on or make changes to this bug.