310653 - ###!!! ASSERTION: Incorrect aDocument: '!aParent || aParent->GetCurrentDoc() == aDocument'

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Alex Vincent [:WeirdAl]]

This assertion stems from bug 278472 and bz's checkin to trunk.  Testcase coming
up in a few moments.

Comment 1

[Alex Vincent [:WeirdAl]]

Attachment: testcase

bz: fyi, the assertion comes from an element that has been created by the
document, but not inserted into the document anywhere.

Comment 2

[Alex Vincent [:WeirdAl]]

00 ntdll!DbgBreakPoint
01 xpcom_core!nsDebugImpl::Break+0x7e [m:\mozilla\xpcom\base\nsdebugimpl.cpp @ 350]
02 xpcom_core!nsDebugImpl::Assertion+0x29e
[m:\mozilla\xpcom\base\nsdebugimpl.cpp @ 266]
03 xpcom_core!NSGlue_Assertion+0x4d [m:\builds\mozdebug\xpcom\build\nsdebug.cpp
@ 107]
04 gklayout!nsGenericElement::doReplaceChild+0x63
[m:\mozilla\content\base\src\nsgenericelement.cpp @ 3416]
05 gklayout!nsGenericElement::ReplaceChild+0x28
[m:\mozilla\content\base\src\nsgenericelement.cpp @ 3019]
06 gklayout!nsXULElement::ReplaceChild+0x18
[m:\mozilla\content\xul\content\src\nsxulelement.h @ 556]
... then it gets into JS land, where:

  node.replaceChild(secondInsertion, firstInsertion);
/*
  node = document.createElement("box");
  firstInsertion  = document.createComment("text one");
  secondInsertion = document.createComment("text two");
*/

Comment 3

[Peter Van der Beken [:peterv]]

Attachment: v1

Comment 4

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 198131 [details] [diff] [review]
v1

a=shaver to fix late-breaking branch regression

Comment 5

[Boris Zbarsky [:bzbarsky]]

Fixed on trunk and 1.8 branch.  Peter, thanks for picking this up!