Closed
Bug 415818
Opened 17 years ago
Closed 17 years ago
"ASSERTION: bad index", "ASSERTION: negative length" with MathML rquote attribute
Categories
(Core :: MathML, defect, P3)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jruderman, Unassigned)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
(deleted),
application/xhtml+xml
|
Details |
Loading the testcase triggers these four assertions:
###!!! ASSERTION: bad index: 'PRUint32(aIndex) < mState.mLength', file /Users/jruderman/trunk/mozilla/layout/base/../../content/base/src/nsTextFragment.h, line 184
###!!! ASSERTION: negative length: 'GetContentEnd() - mContentOffset >= 0', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextFrame.h, line 291
###!!! ASSERTION: integer overflow: 'mMaxTextLength <= mMaxTextLength + aFrame->GetContentLength()', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp, line 1081
###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /Users/jruderman/trunk/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
Flags: blocking1.9?
|
||
Updated•17 years ago
|
Flags: blocking1.9? → blocking1.9+
Priority: -- → P3
Flags: wanted-next+
Flags: blocking1.9-
|
||
Updated•17 years ago
|
Flags: tracking1.9+
|
Reporter | |
Comment 1•17 years ago
|
||
WFM, Mac trunk debug.
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → WORKSFORME
|
||
Updated•17 years ago
|
Flags: in-testsuite?
|
||
Updated•9 years ago
|
Group: core-security → core-security-release
|
||
Updated•9 years ago
|
Group: core-security-release
Pushed by mpalmgren@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/873ea3729257
Add crashtest. r=mats
|
||
Updated•6 years ago
|
Flags: in-testsuite? → in-testsuite+
|
||
Comment 3•6 years ago
|
||
| bugherder | ||
You need to log in
before you can comment on or make changes to this bug.
Description
•