Closed Bug 836925 Opened 12 years ago Closed 2 years ago

"Assertion failure: clearedEntries == 0 (Map should be empty already)" after adopting parent of <bdi>

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: crash, regression, testcase, Whiteboard: qa-not-actionable)

Crash Data

Attachments

(3 files)

testcase
348 bytes, text/html
Details
stack
10.84 KB, text/plain
Details
Patch
1.42 KB, patch
Details | Diff | Splinter Review
Attached file testcase — 
[@ mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap]

Similar to bug 815276, which Simon fixed several weeks ago.
Attached file stack — 

    
    

    
  
On Windows: bp-bp-a4891018-63bf-47cd-abeb-84c492130131.
Crash Signature: [@ mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap(nsINode*, mozilla::dom::Element*)]
[@ nsINode::GetBoolFlag(nsINode::BooleanFlag)]
OS: Mac OS X → All
Hardware: x86_64 → All

    
    

    
  
Simon - please nominate for tracking on Firefox 20 if this is a critical issue.
Assignee: nobody → smontagu

    
    

    
  
ehsan, did we fail to include adoptNode in the implementation plan for dirAuto? It seems we should be treating it the same as binding and unbinding nodes, but I may have got the wrong end of the stick.

    
    

    
  
(In reply to Simon Montagu from comment #4)
> ehsan, did we fail to include adoptNode in the implementation plan for
> dirAuto?

Yeah, I think so.  Sorry about that.

> It seems we should be treating it the same as binding and unbinding
> nodes, but I may have got the wrong end of the stick.

That seems reasonable to me.

    
    

    
  

      
      
      
      

        Attached patch
          
          
        Patch
        — 
          — Splinter Review
      

    


  
After more thought and debugging, I think comment 4 is wrong: the bug only exists with nodes that are not currently bound to the document tree, and the solution is to set the mTransfer flag when setting the properties associated with auto-direction.

There may still be problematic cases though - for example if you have something like
 <div dir=auto><span id = x>Hello</span></div>
and then do adoptNode(x)

More experimentation is probably needed before asking review, but feedback is welcome.

        Attachment #714279 -
        Flags: feedback?(peterv)

        Attachment #714279 -
        Attachment is patch: true
Keywords: regression

    
    

    
  
This has morphed slightly since bug 861606
Summary: Crash during CC after adopting parent of <bdi> → "Assertion failure: clearedEntries == 0 (Map should be empty already)" after adopting parent of <bdi>
Blocks: 900997
No longer blocks: CVE-2013-1686

    
    

    
  
I've hit this crash on http://letras.mus.br/ searching for a song and then loading the page with the lyrics. Report: https://crash-stats.mozilla.com/report/index/a903b6d3-9ab6-461e-ad58-14d592131201

    
    

    
  
Comment 9 looks like a different crash to me, can you file a new bug?

    
  
Crash Signature: [@ mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap(nsINode*, mozilla::dom::Element*)]
[@ nsINode::GetBoolFlag(nsINode::BooleanFlag)] → [@ mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap(nsINode*, mozilla::dom::Element*)]
[@ nsINode::GetBoolFlag(nsINode::BooleanFlag)]
[@ mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap]
[@ nsINode::GetBoolFlag]
Component: DOM → DOM: Core & HTML

    
    

    
  
It seems this crash no longer occurs since I cant find any reports on it , I will close it as WFM and then if it starts to reoccur we can reopen the issue


Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
Flags: in-testsuite?

    
    

    
  
Reopening bug since there are crash reports in the last 6 months.


Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
Whiteboard: qa-not-actionable

    
    

    
  
The bug assignee didn't login in Bugzilla in the last 7 months.

:hsinyi, could you have a look please?

For more information, please visit auto_nag documentation.


Assignee: smontagu → nobody
Flags: needinfo?(htsai)

    
    

    
  
The assertion was removed. And there are no crash reports for the past 6 months. I think we should close this.


Status: REOPENED → RESOLVED
Closed: 3 years ago → 2 years ago
Flags: needinfo?(htsai)
Resolution: --- → WORKSFORME

        Attachment #714279 -
        Flags: feedback?(peterv)

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: