"ASSERTION: dangling frame without a content node"

RESOLVED WORKSFORME

Status

()

Core
MathML
RESOLVED WORKSFORME
12 years ago
10 years ago

People

(Reporter: Jesse Ruderman, Assigned: rbs)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
PowerPC
Mac OS X
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

317 bytes, application/xhtml+xml
Details
(Reporter)

Description

12 years ago
###!!! ASSERTION: dangling frame without a content node: 'content', file /Users/admin/trunk/mozilla/layout/mathml/base/src/nsMathMLFrame.cpp, line 194

The reduced testcase I'm about to attach also triggers the assertion in bug 336065, but before I reduced this, this assertion was alone.

Filing as security-sensitive because this assertion came up in bug 317546, which was sg:critical, and because the word "dangling" scares me.  Is a frame actually kinda-leaked here, and freed only because the frame arena is freed?
(Reporter)

Comment 1

12 years ago
Created attachment 220365 [details]
testcase
(Assignee)

Comment 2

12 years ago
Actually, the assertion is less scary than it seems. It is even harmless (so long as there is no crash).

It is a consequence of the invalid markup due to the lack of the top-level <math> parent.

The code desperately walks up the frame tree, searching for <math>. In its desperation, it reaches the viewport frame, which is the (only) frame without a DOM content node associated to it. Since the buck stops there, the code throws that assertion, and gives up looking for <math>. So no worries here. Suggesting WONTFIX.
(Reporter)

Comment 3

12 years ago
Please remove the assertion, change it assertion to a warning and reword it, or keep the assertion but add a check so it doesn't assert in the case of hitting the viewport frame.

Wontfixing assertion bugs is bad karma, see http://weblogs.mozillazine.org/roadmap/archives/007403.html.  Assertion failures are bugs, just like crashes.
Group: security
We shouldn't assert on bad markup.  We should assert when the Mozilla code is incorrectly written.
(If you want to report bad markup, report it to the error console.)
(Reporter)

Comment 6

11 years ago
WFM on trunk, although that could be because MathML is pretty much broken on trunk.
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Flags: in-testsuite?
Resolution: --- → WORKSFORME
(Reporter)

Comment 7

10 years ago
Crashtest checked in.
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.