###!!! ASSERTION: dangling frame without a content node: 'content', file /Users/admin/trunk/mozilla/layout/mathml/base/src/nsMathMLFrame.cpp, line 194 The reduced testcase I'm about to attach also triggers the assertion in bug 336065, but before I reduced this, this assertion was alone. Filing as security-sensitive because this assertion came up in bug 317546, which was sg:critical, and because the word "dangling" scares me. Is a frame actually kinda-leaked here, and freed only because the frame arena is freed?
Actually, the assertion is less scary than it seems. It is even harmless (so long as there is no crash). It is a consequence of the invalid markup due to the lack of the top-level <math> parent. The code desperately walks up the frame tree, searching for <math>. In its desperation, it reaches the viewport frame, which is the (only) frame without a DOM content node associated to it. Since the buck stops there, the code throws that assertion, and gives up looking for <math>. So no worries here. Suggesting WONTFIX.
Please remove the assertion, change it assertion to a warning and reword it, or keep the assertion but add a check so it doesn't assert in the case of hitting the viewport frame. Wontfixing assertion bugs is bad karma, see http://weblogs.mozillazine.org/roadmap/archives/007403.html. Assertion failures are bugs, just like crashes.
We shouldn't assert on bad markup. We should assert when the Mozilla code is incorrectly written.
(If you want to report bad markup, report it to the error console.)
WFM on trunk, although that could be because MathML is pretty much broken on trunk.
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → WORKSFORME
Crashtest checked in.
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.