338649 - "ASSERTION: Options collection broken" involving optgroup inside option

Status: RESOLVED FIXED

(Core :: Layout: Form Controls, defect)

Description

[Jesse Ruderman]

Security-sensitive only because bug 324918, where this assertion was added, is security-sensitive.

###!!! ASSERTION: Options collection broken: 'opt == aArray->ItemAsOption(aIndex++)', file /Users/admin/trunk/mozilla/content/html/content/src/nsHTMLSelectElement.cpp, line 2143

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Attachment: Patch to fix

The problem is that the GetSelect method on nsHTMLOptionElement and nsHTMLOptGroupElement walks up the entire parent chain, rather than just a chain of optgroup elements. This confuses nsHTMLSelectElement since it gets notificaions from elements that it then doesn't find when walking the tree of just optgroup elements.

I fixed this and also gave the internal GetSelect methods better signatures to avoid extra QIs. Additionally I removed nsHTMLOptionElement::GetSelectFrame since that function isn't used

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 222853 [details] [diff] [review]
Patch to fix

Looks reasonable.

Comment 4

[Jesse Ruderman]

I think Sicking checked this patch in at 2006-07-27 14:06.

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Indeed, thanks.

Comment 6

[Daniel Veditz [:dveditz]]

How could this bug block bug 324918 if that one was fixed in 1.8.0.4 and this one wasn't?

Comment 7

[Daniel Veditz [:dveditz]]

This is either fixed on the branch or never affected it. Long-fixed, removing security flag

Comment 8

[Jesse Ruderman]

Crashtest checked in.