Last Comment Bug 443528 - "ASSERTION: running past end" with -moz-column, pre-wrap, inline-block
: "ASSERTION: running past end" with -moz-column, pre-wrap, inline-block
Status: RESOLVED FIXED
: [sg:critical?]
: assertion, testcase, verified1.9.0.4
Product: Core
Classification: Components
Component: Layout
: Trunk
: All All
: -- critical (vote)
: mozilla1.9.1b2
Assigned To: Mats Palmgren [:mats]
: layout
:
:
: 306663 306939 403600 445288 446181
  Show dependency treegraph
 
Reported: 2008-07-03 19:05 PDT by Jesse Ruderman
Modified: 2008-11-29 19:14 PST (History)
10 users (show)
roc: wanted1.9.1+
dveditz: wanted1.9.0.x+
jruderman: in‑testsuite+
See Also:
Crash Signature:


Attachments
testcase (may cause heap corruption) (485 bytes, text/html)
2008-07-03 19:05 PDT, Jesse Ruderman
no flags Details
Patch rev. 1 (3.79 KB, patch)
2008-10-06 19:10 PDT, Mats Palmgren [:mats]
roc: review+
roc: superreview+
dveditz: approval1.9.0.4+
Details | Diff | Splinter Review
crashtest.diff (1.08 KB, patch)
2008-10-11 17:44 PDT, Mats Palmgren [:mats]
no flags Details | Diff | Splinter Review

Summon comment box

Description Jesse Ruderman 2008-07-03 19:05:24 PDT
Created attachment 328078 [details]
testcase (may cause heap corruption)

Loading the testcase triggers:

###!!! ASSERTION: Shouldn't be incomplete if availableHeight is UNCONSTRAINED.: 'aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file mozilla/layout/generic/nsBlockFrame.cpp, line 1411

###!!! ASSERTION: running past end: 'mCurrent != mListLink', file mozilla/layout/base/../generic/nsLineBox.h, line 611

The second assertion is usually followed by heap corruption, so I'm filing this bug as security sensitive.  I have it set to abort locally.
Comment 1 Mats Palmgren [:mats] 2008-10-06 19:10:06 PDT
Created attachment 342011 [details] [review]
Patch rev. 1

The line that we pass to MarkLineDirty() is an overflow line so
the test "mLines.front()" before using "aLine.prev()" is testing
the wrong line list.  That is the cause of the crash.

I also think the frame could be different from 'this' so we should
use GetContainer(), (or should we just assert GetContainer()==this ?).
Comment 2 Mats Palmgren [:mats] 2008-10-11 17:44:36 PDT
Created attachment 342747 [details] [review]
crashtest.diff
Comment 3 Mats Palmgren [:mats] 2008-10-12 13:52:36 PDT
http://hg.mozilla.org/mozilla-central/rev/12083acc3286

Holding the crashtest until 1.9.0.x is released with a fix.

Filed bug 459597 on the "Shouldn't be incomplete" assertion.

-> FIXED
Comment 4 Daniel Veditz 2008-10-17 10:32:50 PDT
Comment on attachment 342011 [details] [review]
Patch rev. 1

Approved for 1.9.0.4, a=dveditz for release-drivers
Comment 5 Mats Palmgren [:mats] 2008-10-18 09:35:26 PDT
Landed on CVS trunk for 1.9.0.4:
mozilla/layout/generic/nsBlockFrame.cpp  3.959
mozilla/layout/generic/nsBlockFrame.h    3.273
Comment 6 Al Billings [:abillings] 2008-10-28 16:04:17 PDT
Tomcat, can you verify that this assertion is gone with your nightly debug 1.9.0 build?
Comment 7 Carsten Book [:Tomcat] 2008-10-29 14:01:35 PDT
Verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.4pre) Gecko/2008102800 Firefox/3.0.4pre and the Testcase from Mats. I see not the Assertion -> ASSERTION: running past end" with -moz-column..., so verified 1.9.0.4

But i still see 
###!!! ASSERTION: Shouldn't be incomplete if availableHeight is UNCONSTRAINED.: 'aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file /work/mozilla/builds/1.9.0/mozilla/layout/generic/nsBlockFrame.cpp, line 1405 - but this is covered in Bug 459597

Note You need to log in before you can comment on or make changes to this bug.