Open Bug 655858 Opened 13 years ago Updated 2 years ago

"ASSERTION: Want to fire DOMNodeRemoved event, but it's not safe" with XML error in innerHTML setter

Categories

(Core :: DOM: Core & HTML, defect, P3)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86
All
Type:
defect

Tracking

()

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(2 files)

testcase
219 bytes, application/xhtml+xml
Details
stack trace
4.35 KB, text/plain
Details
Attached file testcase — 
###!!! ASSERTION: Want to fire DOMNodeRemoved event, but it's not safe: 'aChild->IsNodeOfType(nsINode::eCONTENT) && static_cast<nsIContent*>(aChild)-> IsInNativeAnonymousSubtree() || IsSafeToRunScript() || sDOMNodeRemovedSuppressCount', file content/base/src/nsContentUtils.cpp, line 3751

This is a recent regression, most likely from bug 650493.
Blocks: 650493
Attached file stack trace — 

    
    

    
  
We should move this code over to using RemoveChildAt and simply not fire mutation events. Parser doesn't in other cases anyway.
OS: Mac OS X → All

    
    

    
  
My fuzzer hits this assertion a lot, which slows it down somewhat.
See Also:  → 1353002
Priority: -- → P3
Component: DOM → DOM: Core & HTML

    
    

    
      
  

    
  
Severity: normal → S3

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: