1032654 - "Assertion failure: aBuilder->GetDocument() == aTextNode->OwnerDoc()" with <template>

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Assertion failure: aBuilder->GetDocument() == aTextNode->OwnerDoc(), at /Users/jruderman/trees/mozilla-central/parser/html/nsHtml5TreeOperation.cpp:127

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[William Chen [:wchen]]

Attachment: Remove invalid assertion from HTML parser.

We are appending text to a text node that has a different owner document than the document builder. This is happening because the text node is inside a template content, and template contents are owned by a different document.

From what I can tell, the assertion here is invalid and the code doesn't actually need the owner document to match. There is also other evidence that the assertion is invalid even if we ignore the template case.

In the call sites:

http://dxr.mozilla.org/mozilla-central/source/parser/html/nsHtml5TreeOperation.cpp#157
http://dxr.mozilla.org/mozilla-central/source/parser/html/nsHtml5TreeOperation.cpp#512

Prior to calling AppendTextToTextNode, we see:

nsHtml5OtherDocUpdate update(aParent->OwnerDoc(), aBuilder->GetDocument());

This suggests that we expect the case where the text node is owned by a document that is different from the document builder. Bug 509666 suggests that it is possible for this to happen when script moves nodes around during parsing, although it doesn't look like there are tests for this which is probably why we don't currently hit the assertion.

Comment 3

[Henri Sivonen (:hsivonen)]

Indeed, the assertion is there to make sure that the case where a script has moved nodes between documents doesn't end up running the path that was, at least prior to bug 902618, optimized for the case where a script hasn't moved nodes between documents. It's possible that the assertion was bogus even before bug 902618 landed, though, since it indeed looks like the callers make sure the update batch is open on the right doc.

Comment 4

[William Chen [:wchen]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5d94612eb6fb

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5d94612eb6fb