771639 - "Assertion failure: node" in ValidateCurrentNode

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Assertion failure: node, at content/base/src/nsRange.cpp:1457

This assertion is part of ValidateCurrentNode, a function added in bug 766426.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Aryeh Gregor (:ayg) (no longer with Mozilla)]

Attachment: Patch

This turns out not to have anything to do with fullscreen.  What CutContents does in this case is:

1) Create an iterator and call Last()

2) Save the current node in a local variable

3) Call Prev() on iterator so that if we delete the local variable, the iterator points to the next node we should delete

4) Delete the node

5) Call ValidateCurrentNode() on the iterator

The problem is that if any mutation occurs in step (4), and the node we just removed is the last one, the iterator will be done.  Then ValidateCurrentNode() will try to get the current node, which will be null.  Then it will assert.  In this case, we should just say it's valid.

Try: https://tbpl.mozilla.org/?tree=Try&rev=09c3dfd3d7ce

Comment 3

[Aryeh Gregor (:ayg) (no longer with Mozilla)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8129536fb25c

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/8129536fb25c