Closed Bug 385845 Opened 12 years ago Closed 9 years ago

"ASSERTION: mDocElement not in doc?" if documentElement is removed during onload

Categories

(Core :: XML, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla2.0b7

People

(Reporter: jruderman, Assigned: philor)

References

Details

(Keywords: assertion, intermittent-failure, testcase)

Attachments

(4 files)

###!!! ASSERTION: mDocElement not in doc?: 'mDocument->IndexOf(mDocElement) != -1', file mozilla/content/xml/document/src/nsXMLContentSink.cpp, line 343
This triggers the assertion, too.
It seems to me that the assertion is bogus; that guarantee simply doesn't exist because of scripts like this one.  (XML parsing is still consistent even if the document tree is being modified as it is parsed.)
Attached file another testcase
Here's another testcase (XHTML this time).
And http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1285965566.1285966438.9435.gz says that reftest/tests/layout/svg/crashtests/385840-1.svg is another testcase.
Attached patch rmSplinter Review
I'm way out of my depth, but I think that the state of the code in 1.8,

317     if (mDocElement) {
318       // Notify document observers that all the content has been stuck
319       // into the document.
320       // XXX do we need to notify for things like PIs?  Or just the
321       // documentElement?
322       NS_ASSERTION(mDocument->IndexOf(mDocElement) != -1,
323                    "mDocElement not in doc?");
324 
325       mozAutoDocUpdate docUpdate(mDocument, UPDATE_CONTENT_MODEL, PR_TRUE);
326       mDocument->ContentInserted(nsnull, mDocElement,
327                                  // XXXbz is this last arg relevant if
328                                  // the container is null?
329                                  mDocument->IndexOf(mDocElement));
330     }

means that the assertion was related to notifying mDocument's observers about mDocElement, and not wanting to tell them about something that wasn't in their document, and so bogus or not it's no longer related to anything that's actually happening where it's being asserted.
Assignee: nobody → philringnalda
Status: NEW → ASSIGNED
Attachment #480355 - Flags: review?(bzbarsky)
OS: Mac OS X → All
Hardware: x86 → All
Version: unspecified → Trunk
Comment on attachment 480355 [details] [diff] [review]
rm

Tempting to claim I can just push this, since it's an orange fix and practically speaking NPOToptB.
Attachment #480355 - Flags: approval2.0?
Whiteboard: [needs approval]
http://hg.mozilla.org/mozilla-central/rev/cc874004357b
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Flags: in-testsuite-
Resolution: --- → FIXED
Whiteboard: [needs approval]
Target Milestone: --- → mozilla2.0b8
Attachment #480355 - Flags: approval2.0?
And http://hg.mozilla.org/mozilla-central/rev/891a83ede325 since I somehow failed to notice the annotation about how layout/xul/base/src/crashtests/321056-1.xhtml was yet another testcase for this.
Blocks: 438871
Whiteboard: [orange]
Target Milestone: mozilla2.0b8 → mozilla2.0b7
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.