199508 - Hiding resize handles triggers assertion in ~nsGenericHTMLElement()

Status: RESOLVED FIXED

(Core :: DOM: Selection, defect, P3)

Description

[kinmoz]

Using my 03/26/2003 Mozilla Win32 debug build ...

Launch Composer, insert an image, click on the image to select it so that the
resize handles appear, then click elsewhere in the document to unselect the
image. You should then see an assertion for each of the resizer anonymous
content nodes we try to hide.


###!!! ASSERTION: Please remove this from the document properly: '!mDocument', f
ile u:/mozilla/content/base/src/nsGenericElement.cpp, line 745
Break: at file u:/mozilla/content/base/src/nsGenericElement.cpp, line 745


Looks like we may have to null out the parent of each of the content nodes
before we null out our comptrs.

Here's the stack to the assertion:


NTDLL! 77f97704()
nsDebug::Assertion(const char * 0x01b4c1b8, const char * 0x01b4c1ac, const char
* 0x01b4c178, int 745) line 270 + 13 bytes
nsDebug::PreCondition(const char * 0x01b4c1b8, const char * 0x01b4c1ac, const
char * 0x01b4c178, int 745) line 429 + 21 bytes
nsGenericElement::~nsGenericElement() line 745 + 35 bytes
nsGenericHTMLElement::~nsGenericHTMLElement() line 253 + 8 bytes
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() line 3511 + 20 bytes
nsHTMLSpanElement::~nsHTMLSpanElement() line 103 + 8 bytes
nsHTMLSpanElement::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsGenericElement::Release(nsGenericElement * const 0x0535d0a8) line 2941 + 185 bytes
nsHTMLSpanElement::Release(nsHTMLSpanElement * const 0x0535d0a8) line 107 + 12 bytes
nsCOMPtr<nsIDOMElement>::assign_assuming_AddRef(nsIDOMElement * 0x00000000) line 479
nsCOMPtr<nsIDOMElement>::assign_with_AddRef(nsISupports * 0x00000000) line 981
nsCOMPtr<nsIDOMElement>::operator=(nsIDOMElement * 0x00000000) line 592
nsHTMLEditor::HideResizers(nsHTMLEditor * const 0x0506caac) line 501
nsHTMLEditor::CheckResizingState(nsHTMLEditor * const 0x0506caac, nsISelection *
0x0507ab80) line 1085 + 12 bytes
ResizerSelectionListener::NotifySelectionChanged(ResizerSelectionListener *
const 0x05097790, nsIDOMDocument * 0x04fbc364, nsISelection * 0x0507ab80, short
3) line 121
nsTypedSelection::NotifySelectionListeners() line 7798
nsSelection::NotifySelectionListeners(short 1) line 3334 + 16 bytes
nsSelection::TakeFocus(nsSelection * const 0x0507aa88, nsIContent * 0x05119a18,
unsigned int 12, unsigned int 12, int 0, int 0) line 2887 + 10 bytes
nsSelection::HandleClick(nsSelection * const 0x0507aa88, nsIContent *
0x05119a18, unsigned int 12, unsigned int 12, int 0, int 0, int 0) line 2586 +
35 bytes
nsFrame::HandlePress(nsFrame * const 0x05090ec0, nsIPresContext * 0x04d1e5e0,
nsGUIEvent * 0x0012f7a0, nsEventStatus * 0x0012f58c) line 1529 + 62 bytes
nsFrame::HandleEvent(nsFrame * const 0x05090ec0, nsIPresContext * 0x04d1e5e0,
nsGUIEvent * 0x0012f7a0, nsEventStatus * 0x0012f58c) line 1013
PresShell::HandleEventInternal(nsEvent * 0x0012f7a0, nsIView * 0x05090640,
unsigned int 1, nsEventStatus * 0x0012f58c) line 6318 + 38 bytes
PresShell::HandleEvent(PresShell * const 0x05079fd4, nsIView * 0x05090640,
nsGUIEvent * 0x0012f7a0, nsEventStatus * 0x0012f58c, int 0, int & 1) line 6211 +
25 bytes
nsViewManager::HandleEvent(nsView * 0x05090370, nsGUIEvent * 0x0012f7a0, int 0)
line 2221
nsView::HandleEvent(nsViewManager * 0x0501fa10, nsGUIEvent * 0x0012f7a0, int 0)
line 309
nsViewManager::DispatchEvent(nsViewManager * const 0x0501fa10, nsGUIEvent *
0x0012f7a0, nsEventStatus * 0x0012f6a0) line 1951 + 23 bytes
HandleEvent(nsGUIEvent * 0x0012f7a0) line 83
nsWindow::DispatchEvent(nsWindow * const 0x0509043c, nsGUIEvent * 0x0012f7a0,
nsEventStatus & nsEventStatus_eIgnore) line 1150 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f7a0) line 1171
nsWindow::DispatchMouseEvent(unsigned int 302, unsigned int 1, nsPoint *
0x00000000) line 5437 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 302, unsigned int 1, nsPoint *
0x00000000) line 5694
nsWindow::ProcessMessage(unsigned int 513, unsigned int 1, long 17170511, long *
0x0012fc30) line 4138 + 28 bytes
nsWindow::WindowProc(HWND__ * 0x00060650, unsigned int 513, unsigned int 1, long
17170511) line 1437 + 27 bytes
USER32! 77e11d0a()
USER32! 77e11bc8()
USER32! 77e11cef()
nsAppShellService::Run(nsAppShellService * const 0x00e72150) line 480
main1(int 1, char * * 0x00262698, nsISupports * 0x00e882f0) line 1271 + 32 bytes
main(int 1, char * * 0x00262698) line 1642 + 37 bytes
mainCRTStartup() line 338 + 17 bytes

Comment 1

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

nsHTMLEditor::DeleteRefToAnonymousNode misses content->SetDocument(nsnull,
PR_TRUE, PR_TRUE);

Comment 2

[kinmoz]

Attachment: Patch Rev 1

This patch nulls out the document and parent for each resizer content node.

Comment 3

[kinmoz]

Taking.

Comment 4

[kinmoz]

Patch Rev 1 checked into TRUNK:

  mozilla/editor/libeditor/html/nsHTMLObjectResizer.cpp  revision 1.4