376223 - "ASSERTION: Some frame destructors were not called" with xul:listbox, html:td

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Jesse Ruderman]

Attachment: testcase (reload to see the assertion)

[sg:critical] because a slightly modified version of the testcase makes Firefox crash dereferencing a deleted object.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

This fixes it. We weren't processing pseudoframes in CreateListBoxContent so the anonymous table frame created for the table cell wasn't being moved into frameItems; it and its descendants were just lost.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 261347 [details] [diff] [review]
fix

r+sr=bzbarsky

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in.

Comment 5

[Daniel Veditz [:dveditz]]

The testcase with the modification in comment 1 crashes a 1.8.0.12pre debug build because the nsStyleContext is 0xdddddddd (deleted). Never saw the described assertions but those may have been added on trunk.

The patch in this bug makes it stop.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Yeah, those assertiosn are trunk-only.

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 261347 [details] [diff] [review]
fix

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

fixed on branches.

Comment 9

[Tony Chung [:tchung]]

verified fix on branch.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0

Comment 10

[Jesse Ruderman]

Reloading the testcase for this bug triggers a "No common ancestor at all???" assertion.  I filed bug 383806 for that.

Comment 11

[Jesse Ruderman]

Crashtest checked in.