396836 - "ASSERTION: Adding child where we already have a child?" with document.write into frame

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
1. Load http://htmledit.squarefree.com/
2. Type stuff

Result: For every letter pressed, 

###!!! ASSERTION: Adding child where we already have a child?  This will likely misbehave: 'Error', file /Users/jruderman/trunk/mozilla/docshell/shistory/src/nsSHEntry.cpp, line 543

(Split from bug 344216.)

Comment 1

[Boris Zbarsky [:bzbarsky]]

I only see the assert on load here.  The issue is that the root docshell has a non-null mLSHE, but we're writing into an existing kid frame.  I think the same effect could be achieved by starting a new load into such an existing frame before the toplevel page is done loading.

Someone needs to redesign session history.

Comment 2

[Daniel Holbert [:dholbert]]

I get this same assertion when logging into an AIM account on www.meebo.com, using a current Linux trunk build.

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+2]]

It only happens for me when loading this page. It is the same stack as what we have on bug 462076.

Comment 4

[Boris Zbarsky [:bzbarsky]]

See bug 344216 comment 7.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Fixed (by bug 462076)