"ASSERTION: Some frame destructors were not called" with xul:listbox, html:td

RESOLVED FIXED

Status

()

Core
XUL
--
critical
RESOLVED FIXED
11 years ago
9 years ago

People

(Reporter: Jesse Ruderman, Assigned: roc)

Tracking

(Blocks: 1 bug, 5 keywords)

Trunk
x86
Mac OS X
assertion, crash, fixed1.8.0.12, testcase, verified1.8.1.4
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9 ?
blocking1.8.1.4 +
wanted1.8.1.x +
blocking1.8.0.12 +
wanted1.8.0.x +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical?])

Attachments

(2 attachments)

(Reporter)

Description

11 years ago
Created attachment 260329 [details]
testcase (reload to see the assertion)

[sg:critical] because a slightly modified version of the testcase makes Firefox crash dereferencing a deleted object.
Flags: blocking1.9?
(Reporter)

Updated

11 years ago
Whiteboard: [sg:critical?]
Created attachment 261347 [details] [diff] [review]
fix

This fixes it. We weren't processing pseudoframes in CreateListBoxContent so the anonymous table frame created for the table cell wasn't being moved into frameItems; it and its descendants were just lost.
Assignee: nobody → roc
Status: NEW → ASSIGNED
Attachment #261347 - Flags: superreview?(bzbarsky)
Attachment #261347 - Flags: review?(bzbarsky)
Comment on attachment 261347 [details] [diff] [review]
fix

r+sr=bzbarsky
Attachment #261347 - Flags: superreview?(bzbarsky)
Attachment #261347 - Flags: superreview+
Attachment #261347 - Flags: review?(bzbarsky)
Attachment #261347 - Flags: review+
checked in.
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
The testcase with the modification in comment 1 crashes a 1.8.0.12pre debug build because the nsStyleContext is 0xdddddddd (deleted). Never saw the described assertions but those may have been added on trunk.

The patch in this bug makes it stop.
Flags: wanted1.8.1.x+
Flags: wanted1.8.0.x+
Flags: blocking1.8.1.4+
Flags: blocking1.8.0.12+
Yeah, those assertiosn are trunk-only.
Attachment #261347 - Flags: approval1.8.1.4?
Attachment #261347 - Flags: approval1.8.0.12?
Comment on attachment 261347 [details] [diff] [review]
fix

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers
Attachment #261347 - Flags: approval1.8.1.4?
Attachment #261347 - Flags: approval1.8.1.4+
Attachment #261347 - Flags: approval1.8.0.12?
Attachment #261347 - Flags: approval1.8.0.12+
fixed on branches.
Keywords: fixed1.8.0.12, fixed1.8.1.4

Comment 9

10 years ago
verified fix on branch.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Keywords: fixed1.8.1.4 → verified1.8.1.4
Group: security
(Reporter)

Comment 10

10 years ago
Reloading the testcase for this bug triggers a "No common ancestor at all???" assertion.  I filed bug 383806 for that.
(Reporter)

Comment 11

10 years ago
Crashtest checked in.
Flags: in-testsuite+

Updated

9 years ago
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
You need to log in before you can comment on or make changes to this bug.