Last Comment Bug 376223 - "ASSERTION: Some frame destructors were not called" with xul:listbox, html:td
: "ASSERTION: Some frame destructors were not called" with xul:listbox, html:td
Status: RESOLVED FIXED
[sg:critical?]
: assertion, crash, fixed1.8.0.12, testcase, verified1.8.1.4
Product: Core
Classification: Components
Component: XUL (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: ---
Assigned To: Robert O'Callahan (:roc) (Exited; email my personal email if necessary)
:
Mentors:
Depends on:
Blocks: 344486 framedest
  Show dependency treegraph
 
Reported: 2007-04-02 01:56 PDT by Jesse Ruderman
Modified: 2008-07-31 03:23 PDT (History)
8 users (show)
jruderman: blocking1.9?
dveditz: blocking1.8.1.4+
dveditz: wanted1.8.1.x+
dveditz: blocking1.8.0.12+
dveditz: wanted1.8.0.x+
jruderman: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (reload to see the assertion) (625 bytes, application/xhtml+xml)
2007-04-02 01:56 PDT, Jesse Ruderman
no flags Details
fix (1.38 KB, patch)
2007-04-11 22:32 PDT, Robert O'Callahan (:roc) (Exited; email my personal email if necessary)
bzbarsky: review+
bzbarsky: superreview+
dveditz: approval1.8.1.4+
dveditz: approval1.8.0.12+
Details | Diff | Review

Description Jesse Ruderman 2007-04-02 01:56:58 PDT
Created attachment 260329 [details]
testcase (reload to see the assertion)

[sg:critical] because a slightly modified version of the testcase makes Firefox crash dereferencing a deleted object.
Comment 2 Robert O'Callahan (:roc) (Exited; email my personal email if necessary) 2007-04-11 22:32:52 PDT
Created attachment 261347 [details] [diff] [review]
fix

This fixes it. We weren't processing pseudoframes in CreateListBoxContent so the anonymous table frame created for the table cell wasn't being moved into frameItems; it and its descendants were just lost.
Comment 3 Boris Zbarsky [:bz] 2007-04-11 23:42:41 PDT
Comment on attachment 261347 [details] [diff] [review]
fix

r+sr=bzbarsky
Comment 4 Robert O'Callahan (:roc) (Exited; email my personal email if necessary) 2007-04-13 09:51:08 PDT
checked in.
Comment 5 Daniel Veditz [:dveditz] 2007-04-16 19:10:08 PDT
The testcase with the modification in comment 1 crashes a 1.8.0.12pre debug build because the nsStyleContext is 0xdddddddd (deleted). Never saw the described assertions but those may have been added on trunk.

The patch in this bug makes it stop.
Comment 6 Boris Zbarsky [:bz] 2007-04-16 19:35:22 PDT
Yeah, those assertiosn are trunk-only.
Comment 7 Daniel Veditz [:dveditz] 2007-04-18 16:24:06 PDT
Comment on attachment 261347 [details] [diff] [review]
fix

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers
Comment 8 Robert O'Callahan (:roc) (Exited; email my personal email if necessary) 2007-04-19 21:02:18 PDT
fixed on branches.
Comment 9 Tony Chung [:tchung] 2007-05-15 15:04:36 PDT
verified fix on branch.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Comment 10 Jesse Ruderman 2007-06-08 16:43:10 PDT
Reloading the testcase for this bug triggers a "No common ancestor at all???" assertion.  I filed bug 383806 for that.
Comment 11 Jesse Ruderman 2007-12-19 15:15:00 PST
Crashtest checked in.

Note You need to log in before you can comment on or make changes to this bug.