Last Comment Bug 310653 - ###!!! ASSERTION: Incorrect aDocument: '!aParent || aParent->GetCurrentDoc() == aDocument'
: ###!!! ASSERTION: Incorrect aDocument: '!aParent || aParent->GetCurrentDoc() ...
Status: RESOLVED FIXED
: assertion, fixed1.8, testcase
Product: Core
Classification: Components
Component: DOM: Core & HTML (show other bugs)
: Trunk
: All All
: -- normal (vote)
: ---
Assigned To: Peter Van der Beken [:peterv]
:
: Andrew Overholt [:overholt]
Mentors:
Depends on:
Blocks: 278472
  Show dependency treegraph
 
Reported: 2005-09-30 23:37 PDT by Alex Vincent [:WeirdAl]
Modified: 2008-07-31 02:43 PDT (History)
1 user (show)
mscott: blocking1.8b5+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (3.38 KB, application/vnd.mozilla.xul+xml)
2005-09-30 23:39 PDT, Alex Vincent [:WeirdAl]
no flags Details
v1 (757 bytes, patch)
2005-10-01 07:20 PDT, Peter Van der Beken [:peterv]
bzbarsky: review+
bzbarsky: superreview+
shaver: approval1.8b5+
Details | Diff | Splinter Review

Description Alex Vincent [:WeirdAl] 2005-09-30 23:37:45 PDT
This assertion stems from bug 278472 and bz's checkin to trunk.  Testcase coming
up in a few moments.
Comment 1 Alex Vincent [:WeirdAl] 2005-09-30 23:39:07 PDT
Created attachment 198110 [details]
testcase

bz: fyi, the assertion comes from an element that has been created by the
document, but not inserted into the document anywhere.
Comment 2 Alex Vincent [:WeirdAl] 2005-09-30 23:55:53 PDT
00 ntdll!DbgBreakPoint
01 xpcom_core!nsDebugImpl::Break+0x7e [m:\mozilla\xpcom\base\nsdebugimpl.cpp @ 350]
02 xpcom_core!nsDebugImpl::Assertion+0x29e
[m:\mozilla\xpcom\base\nsdebugimpl.cpp @ 266]
03 xpcom_core!NSGlue_Assertion+0x4d [m:\builds\mozdebug\xpcom\build\nsdebug.cpp
@ 107]
04 gklayout!nsGenericElement::doReplaceChild+0x63
[m:\mozilla\content\base\src\nsgenericelement.cpp @ 3416]
05 gklayout!nsGenericElement::ReplaceChild+0x28
[m:\mozilla\content\base\src\nsgenericelement.cpp @ 3019]
06 gklayout!nsXULElement::ReplaceChild+0x18
[m:\mozilla\content\xul\content\src\nsxulelement.h @ 556]
... then it gets into JS land, where:

  node.replaceChild(secondInsertion, firstInsertion);
/*
  node = document.createElement("box");
  firstInsertion  = document.createComment("text one");
  secondInsertion = document.createComment("text two");
*/
Comment 3 Peter Van der Beken [:peterv] 2005-10-01 07:20:27 PDT
Created attachment 198131 [details] [diff] [review]
v1
Comment 4 Mike Shaver (:shaver -- probably not reading bugmail closely) 2005-10-02 08:11:37 PDT
Comment on attachment 198131 [details] [diff] [review]
v1

a=shaver to fix late-breaking branch regression
Comment 5 Boris Zbarsky [:bz] (still a bit busy) 2005-10-02 08:54:17 PDT
Fixed on trunk and 1.8 branch.  Peter, thanks for picking this up!

Note You need to log in before you can comment on or make changes to this bug.