36319 - GetAttribute asserts when gettting the name on destruction

Status: VERIFIED DUPLICATE of bug 36362

(Core :: DOM: HTML Parser, defect, P3)

Description

[rods (gone)]

This could be a table, form, DOM, or parser bug.
testcase is attached, I am starting with parser because the content tree doesn't 
look right:

docshell=010ADAB0
html@020A5E78 refcount=3<
  head@020A5E18 refcount=2<
  >
  Text@020F3A30 refcount=3<\n>
  body@020F3938 refcount=3<
    Text@02129320 refcount=3<\n>
    input@02319A6C name=domain refcount=4<>
    Text@02337070 refcount=3<\n>
    table@0212AE48 refcount=4<
      form@0212AD8C refcount=4<
      >
    >
    Text@0231C660 refcount=3<\n>
  >
>

Shouldn't the input be inside the table?

Comment 1

[rods (gone)]

Attachment: simple test case

Comment 2

[rods (gone)]

Stack trace:

NTDLL! 77f762e8()
nsDebug::Assertion(const char * 0x01f76b2c, const char * 0x002d5e74, const char 
* 0x01f76af0, int 1300) line 191 + 13 bytes
nsDebug::NotReached(const char * 0x01f76b2c, const char * 0x01f76af0, int 1300) 
line 302 + 22 bytes
nsGenericHTMLElement::GetAttribute(int 3, nsIAtom * 0x011015d0 {"name"}, 
nsString & {""}) line 1300 + 21 bytes
nsHTMLInputElement::GetAttribute(const nsHTMLInputElement * const 0x02319a6c, 
int 3, nsIAtom * 0x011015d0 {"name"}, nsString & {""}) line 137 + 26 bytes
nsFormControlList::RemoveElementFromTable(nsIFormControl * 0x02319a70, int 0) 
line 1019 + 45 bytes
nsHTMLFormElement::RemoveElement(nsHTMLFormElement * const 0x02128690, 
nsIFormControl * 0x02319a70, int 0) line 505
nsHTMLInputElement::~nsHTMLInputElement() line 211
nsHTMLInputElement::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsHTMLInputElement::Release(nsHTMLInputElement * const 0x02319a60) line 257 + 34 
bytes
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() line 2817 + 12 
bytes
nsBodyInner::~nsBodyInner() line 154 + 32 bytes
nsHTMLBodyElement::~nsHTMLBodyElement() line 653 + 11 bytes
nsHTMLBodyElement::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsHTMLBodyElement::Release(nsHTMLBodyElement * const 0x020f24c0) line 657 + 157 
bytes
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() line 2817 + 12 
bytes
nsHTMLHtmlElement::~nsHTMLHtmlElement() line 100 + 11 bytes
nsHTMLHtmlElement::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsHTMLHtmlElement::Release(nsHTMLHtmlElement * const 0x020a4cb0) line 104 + 154 
bytes
nsDocument::~nsDocument() line 670 + 27 bytes
nsMarkupDocument::~nsMarkupDocument() line 51 + 8 bytes
nsHTMLDocument::~nsHTMLDocument() line 270 + 37 bytes
nsHTMLDocument::`scalar deleting destructor'() + 15 bytes
nsDocument::Release(nsDocument * const 0x020a3e80) line 800 + 158 bytes
nsHTMLDocument::Release(nsHTMLDocument * const 0x020a3e80) line 310
nsCOMPtr<nsIDocument>::~nsCOMPtr<nsIDocument>() line 465
DocumentViewerImpl::~DocumentViewerImpl() line 389 + 130 bytes
DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
DocumentViewerImpl::Release(DocumentViewerImpl * const 0x020a3c30) line 306 + 
154 bytes
nsCOMPtr<nsIContentViewer>::assign_assuming_AddRef(nsIContentViewer * 
0x00000000) line 447
nsCOMPtr<nsIContentViewer>::assign_with_AddRef(nsISupports * 0x00000000) line 
818
nsCOMPtr<nsIContentViewer>::operator=(nsIContentViewer * 0x00000000) line 557
nsDocShell::Destroy(nsDocShell * const 0x010e6e84) line 1296
nsWebShell::Destroy(nsWebShell * const 0x010e6e84) line 2031
nsBrowserWindow::Destroy(nsBrowserWindow * const 0x010a8da0) line 247
nsBrowserWindow::CloseAllWindows() line 559
nsViewerApp::Destroy() line 190
nsViewerApp::Exit(nsViewerApp * const 0x00ec3c90) line 402
nsBrowserWindow::DispatchMenuItem(int 40002) line 773
nsNativeBrowserWindow::DispatchMenuItem(int 40002) line 145
HandleBrowserEvent(nsGUIEvent * 0x0012fe10) line 597 + 21 bytes
nsWindow::DispatchEvent(nsWindow * const 0x010a8c74, nsGUIEvent * 0x0012fe10, 
nsEventStatus & nsEventStatus_eIgnore) line 511 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fe10) line 532
nsWindow::ProcessMessage(unsigned int 273, unsigned int 40002, long 0, long * 
0x0012feb4) line 2161 + 21 bytes
nsWindow::WindowProc(HWND__ * 0x0046080a, unsigned int 273, unsigned int 40002, 
long 0) line 740 + 27 bytes

Comment 3

[rickg]

The html given really sucks, and we've done as well as can be expected. The 
assertion is table related (says Rods) so it's off to karnaze.

Comment 4

[rods (gone)]

*** Bug 36436 has been marked as a duplicate of this bug. ***

Comment 5

[Kathleen :Brade]

cc jst

Comment 6

[Kathleen :Brade]

duplicate of bug #36362 (per conversation with nisheeth)


*** This bug has been marked as a duplicate of 36362 ***

Comment 7

[ckritzer (gone)]

Okay if this is a dup of 36362 (which is marked VERIFIED FIXED), then this is 
fixed also.
Marking VERIFIED DUPLICATE on:
- LinuxRH62 2000-09-13-08-M18 Commercial
- Win98     2000-09-13-08-M18 Mozilla
- MacOS86   2000-09-13-04-M18 Commercial