895264 - "ASSERTION: negative length" with bidi, caret browsing, selection tweaking

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Jesse Ruderman]

Attachment: testcase

1. Create a profile with the following prefs.js:

     user_pref("accessibility.browsewithcaret", true);
     user_pref("bidi.browser.ui", true);
     user_pref("bidi.direction", 2);

2. Load the testcase
3. Click to the right of the 'X'

###!!! ASSERTION: negative length: 'GetContentEnd() - mContentOffset >= 0', file layout/generic/nsTextFrame.h, line 435

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Simon Montagu :smontagu]

This is fixed by the patch in bug 887631

Comment 3

[Al Billings [:abillings - ex-MoCo]]

Is Firefox 22 unaffected by this?

Comment 4

[Simon Montagu :smontagu]

The bug is not reproducible on trunk builds before 2013-05-08, so Firefox 22 should be unaffected, but I haven't tested.