377592 - "ASSERTION: post-reflow queues not empty. This means we're leaking" with XBL, svg:foreignObject, xul:menuitem

Status: VERIFIED FIXED

(Core :: XUL, defect, P2)

Description

[Jesse Ruderman]

Attachment: testcase (reload to see the assertions)

*Reloading* the testcase triggers:

###!!! ASSERTION: post-reflow queues not empty.  This means we're leaking: 'mFirstCallbackEventRequest == nsnull && mLastCallbackEventRequest == nsnull', file /Users/jruderman/trunk/mozilla/layout/base/nsPresShell.cpp, line 1451

###!!! ASSERTION: Some frame destructors were not called: 'mFrameCount == 0', file /Users/jruderman/trunk/mozilla/layout/base/nsPresShell.cpp, line 669

The latter assertion often indicates the presence of an exploitable memory safety bug (see bug 334514), so having this fixed would be good for security testing if nothing else.

I don't have a clue whether this is a XUL, SVG, or XBL bug.

Comment 1

[Jesse Ruderman]

Still happens on trunk.

Comment 2

[Jesse Ruderman]

Still happens on trunk.  (I had hoped the patch in bug 394800 might fix this.)

Comment 3

[Jesse Ruderman]

Given bug 400779, I'm guessing this is a XUL bug rather than an SVG bug.

Comment 4

[Jesse Ruderman]

Moving from P3 to P2 because this bug gets in the way of testing for an important assertion.  The sooner this is fixed, the sooner we will find out whether there are other ways to trigger this assertion.

Comment 5

[Mike Schroepfer]

Neil can you take this?

Comment 6

[Jesse Ruderman]

I don't see this any more.

--> FIXED by Mats' patch in bug 395628.

Comment 7

[Jesse Ruderman]

Crashtest checked in.

Comment 8

[Carsten Book [:Tomcat]]

verified fixed using the testcase and Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b3pre) Gecko/2008011009 Firefox/3.0b3pre ID:2008011009

- Verified fixed