Closed
Bug 368860
Opened 18 years ago
Closed 18 years ago
"ASSERTION: bad index" in nsTextFragment.h with ‏ and tables
Categories
(Core :: Layout: Text and Fonts, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: roc)
References
Details
(Keywords: assertion, testcase, Whiteboard: [sg:moderate?] post 1.8-branch)
Attachments
(2 files)
|
(deleted),
text/html
|
Details | |
|
(deleted),
patch
|
dbaron
:
review+
dbaron
:
superreview+
|
Details | Diff | Splinter Review |
Loading the testcase triggers:
###!!! ASSERTION: bad index: 'PRUint32(aIndex) < mState.mLength', file /Users/admin/trunk/mozilla/layout/base/../../content/base/src/nsTextFragment.h, line 183
This looks like a "read past end of buffer" bug, so filing as security-sensitive.
|
Reporter | |
Comment 1•18 years ago
|
||
|
|
Reporter | |
Updated•18 years ago
|
Flags: blocking1.9?
|
|
Reporter | |
Updated•18 years ago
|
Whiteboard: [sg:moderate?]
|
Assignee | |
Comment 3•18 years ago
|
||
Avoid the out-of-bounds access.
This code is going away with the new textframe, anyway.
Assignee: nobody → roc
Status: NEW → ASSIGNED
Attachment #254258 -
Flags: superreview?(dbaron)
Attachment #254258 -
Flags: review?(dbaron)
|
||
Comment 4•18 years ago
|
||
I don't see this assertion on the trunk. Was it fixed elsewhere?
|
|
Reporter | |
Comment 5•18 years ago
|
||
Same here. roc said "This code is going away with the new textframe, anyway", so the bug 370588 landing probably took care of it.
|
|
Assignee | |
Comment 6•18 years ago
|
||
No, this code hasn't gone away yet, and won't until we turn on the new textframe. I don't know why the assertion has gone away.
|
|
||
Updated•18 years ago
|
Attachment #254258 -
Flags: superreview?(dbaron)
Attachment #254258 -
Flags: superreview+
Attachment #254258 -
Flags: review?(dbaron)
Attachment #254258 -
Flags: review+
|
|
Assignee | |
Comment 7•18 years ago
|
||
Fixed.
Status: ASSIGNED → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
|
|
Assignee | |
Updated•18 years ago
|
Flags: blocking1.9? → blocking1.9+
|
||
Updated•18 years ago
|
Flags: wanted1.8.1.x-
Whiteboard: [sg:moderate?] → [sg:moderate?] post 1.8-branch
|
|
||
Updated•18 years ago
|
Group: security
Component: Layout: BiDi Hebrew & Arabic → Layout: Text
QA Contact: layout.bidi → layout.fonts-and-text
You need to log in
before you can comment on or make changes to this bug.
Description
•