459608 - ASSERTION: GetPrimaryFrameFor() called while frames are being destroyed!: '!mIsDestroyingFrames'

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Mats Palmgren (inactive)]

I've just added this assertion in bug 458636.
I triggers when loading the mochitest:
content/tests/widgets/test_popupremoving.xul

###!!! ASSERTION: GetPrimaryFrameFor() called while frames are being destroyed!: '!mIsDestroyingFrames', file /usr/moz/hg3/layout/base/nsFrameManager.cpp, line 328

This usually means there's a path to a bad crash (using freed frames or such).
I don't know if that's the case here or if it's harmless, but I'm filing
the bug as security-sensitive just in case.

Comment 1

[Mats Palmgren (inactive)]

Attachment: stack for the GetPrimaryFrameFor() assertion

Comment 2

[Mats Palmgren (inactive)]

Attachment: stack for the "killing mutation events" assertion

test_popupremoving.xul also triggers:

ASSERTION: killing mutation events: 'nsContentUtils::IsSafeToRunScript()', file ../../../dist/include/content/nsContentUtils.h, line 1512

Here's the stack for that assertion.

Comment 3

[Jesse Ruderman]

> ###!!! ASSERTION: GetPrimaryFrameFor() called while frames are being
> destroyed!: '!mIsDestroyingFrames', file
> /usr/moz/hg3/layout/base/nsFrameManager.cpp, line 328

This assertion was removed in rev e9921507713b:
user:        Boris Zbarsky
date:        Thu Dec 24 16:20:06 2009 -0500
summary:     Bug 500882 part 7.  Remove the old GetPrimaryFrameFor API.  r=roc, sr=dbaron

Comment 4

[Boris Zbarsky [:bzbarsky]]

Yeah, that bug's fix got rid of the whole class of "dangling frame pointer mapped to a content node" issues.

Comment 5

[Jesse Ruderman]

test_popupremoving doesn't trigger any assertions now :)

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268460426.1268461747.4378.gz&fulltext=1