341320 - ASSERTION: Tag mismatch. Closing tag on wrong context or something?: 'nodeType == aTag'

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect, P4)

Description

[Mats Palmgren (inactive)]

STEPS TO REPRODUCE
1. load URL in a debug build

ACTUAL RESULTS
###!!! ASSERTION: Tag mismatch.  Closing tag on wrong context or something?: 'nodeType == aTag', file nsHTMLContentSink.cpp, line 1197

It's 100% reproducable.

BUILDS AND PLATFORMS TESTED
I saw this in a tree that is up-to-date, but not in another tree that is a
few days old... I recursevily diffed parser/htmlparser/src and the only 
difference is in parser/htmlparser/src/nsElementTable.cpp:
rev. 3.194  -  bug occurs
rev. 3.193  -  bug does not occur

So it looks like a regression from bug 312704

Comment 1

[Mats Palmgren (inactive)]

Attachment: Testcase

Comment 2

[Boris Zbarsky [:bzbarsky]]

Bug 312704 added this assertion in the content sink.  The actual problem, on this testcase, has probably been there "forever" or so....

Comment 3

[Boris Zbarsky [:bzbarsky]]

So in this case:

(gdb) p nodeType
$1 = eHTMLTag_form
(gdb) p aTag
$2 = eHTMLTag_body
(gdb) p mStackPos
$8 = 2
(gdb) p mStack[0]
$9 = {mType = eHTMLTag_html, mContent = 0x89f1900, mNumFlushed = 2, mInsertionPoint = -1}
(gdb) p mStack[1]
$10 = {mType = eHTMLTag_body, mContent = 0x8a52798, mNumFlushed = 2, 
  mInsertionPoint = -1}
(gdb) p mStack[2]
$11 = {mType = eHTMLTag_form, mContent = 0x8a230f0, mNumFlushed = 1, 
  mInsertionPoint = -1}

What happens is that this testcase sends an OpenForm() with no matching CloseForm().  So the tag stack does in fact get confused, but this is not a regression from bug 312704.  It might be a regression in general, of course.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

This is totally just bug 136397. The DTD doesn't actually know that the form is still open, so it blindly reports the body as closing before the form.

There's actually code to deal with this case http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/html/document/src/nsHTMLContentSink.cpp&rev=3.758&root=/cvsroot#1249  . It seems slightly wrong (it looks like <embed><form></embed> will fail to call DoneAddingChildren on the embed element), but it's there. I'll try to get to bug 136397 as soon as I can, which will fix this bug by making the DTD aware of the open form.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Quiet the assertion

My previous comment was wrong: the recursive call to CloseContainer handles things correctly. Given that, this patch will quiet these warning until I get a chance to fix the DTD to not send such mismatched notifications.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

I checked in the assertion "fix".