"ASSERTION: negative length" with bidi, caret browsing, selection tweaking

RESOLVED FIXED

Status

()

Core
Layout: Text
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(firefox-esr17 unaffected, firefox-esr24 fixed, b2g18 unaffected, b2g-v1.1hd unaffected, b2g-v1.2 unaffected)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 777600 [details]
testcase

1. Create a profile with the following prefs.js:

     user_pref("accessibility.browsewithcaret", true);
     user_pref("bidi.browser.ui", true);
     user_pref("bidi.direction", 2);

2. Load the testcase
3. Click to the right of the 'X'

###!!! ASSERTION: negative length: 'GetContentEnd() - mContentOffset >= 0', file layout/generic/nsTextFrame.h, line 435
(Reporter)

Comment 1

5 years ago
Created attachment 777601 [details]
stack
This is fixed by the patch in bug 887631
Depends on: 887631
Status: NEW → RESOLVED
Last Resolved: 5 years ago
status-firefox23: --- → fixed
status-firefox24: --- → fixed
status-firefox25: --- → fixed
Resolution: --- → FIXED
Flags: in-testsuite?

Comment 3

5 years ago
Is Firefox 22 unaffected by this?
The bug is not reproducible on trunk builds before 2013-05-08, so Firefox 22 should be unaffected, but I haven't tested.
status-firefox23: fixed → ---
status-firefox24: fixed → ---
status-firefox25: fixed → ---

Updated

5 years ago
status-firefox-esr17: --- → unaffected
status-firefox-esr24: --- → fixed

Updated

5 years ago
status-b2g18: --- → unaffected
status-b2g-v1.1hd: --- → unaffected
status-b2g-v1.2: --- → unaffected
Group: core-security
You need to log in before you can comment on or make changes to this bug.