Closed Bug 784905 Opened 8 years ago Closed 8 years ago

"Assertion failure: uint32_t(startOffset) <= startParent->Length() && uint32_t(endOffset) <= endParent->Length()"

Categories

(Core :: MathML, defect)

x86_64
macOS
defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 785720

People

(Reporter: jruderman, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file testcase
Assertion failure: uint32_t(startOffset) <= startParent->Length() && uint32_t(endOffset) <= endParent->Length(), at content/base/src/nsContentIterator.cpp:1203

This assertion was added in bug 767169, so maybe it's related to bug 772387.  But this isn't the first problem caused by MathML-layout's habit of modifying the DOM.
Attached file stack trace
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: CVE-2012-4180
You need to log in before you can comment on or make changes to this bug.