368276 - "ASSERTION: identical" and "ASSERTION: sorting error" with quotes and XUL

Status: RESOLVED FIXED

(Core :: XBL, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: identical: 'pseudoType1 != pseudoType2', file /Users/admin/trunk/mozilla/layout/base/nsGenConList.cpp, line 133

###!!! ASSERTION: sorting error: 'IsLast(aNode) || NodeAfter(Next(aNode), aNode)', file /Users/admin/trunk/mozilla/layout/base/nsGenConList.cpp, line 198

Comment 2

[Boris Zbarsky [:bzbarsky]]

So this is basically an XBL bug; I wonder whether we have it filed...

The issue is that we get into nsBindingManager::ContentRemoved and notify the frame constructor _before_ we modify the insertion point information, since we need to find the frames in the right place.

But in this case, the <q> is an {ib} split, so we reframe the containing block, and in the process of doing that we end up recreating the <q> frames (even though it's not a child of the <dialog> anymore!) because the <q> is still in the insertion point array...

Then we unwind and remove the <q> from the insertion point, but the bogus frames are still there.

This looks pretty bad to me.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Not blocking since so far this is only an assertion. However it's mine for sure so I'll try to get to it before 1.9

Comment 4

[Jesse Ruderman]

WFM, Mac trunk.

bz, is the underlying problem you mentioned in comment 2 still around?  If so, can you please file a new bug?

Comment 5

[Boris Zbarsky [:bzbarsky]]

This got fixed by fixing that underlying problem in bug 382376.

Comment 6

[Jesse Ruderman]

The same assertions can be triggered with a different testcase; see bug 367251.

Comment 7

[Jesse Ruderman]

Crashtest checked in.