402830 - ASSERTION: frame was not removed from primary map or was readded to map after being removed frame map before destruction or was readded to map after being removed

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which triggers this assertion while loading in a current debug trunk build on windows.
It also seems to crash after that in my debug trunk build, but not in a normal build.

###!!! ASSERTION: frame was not removed from primary frame map before destructio
n or was readded to map after being removed: 'Not Reached', file c:/mozilla-buil
d/mozilla/layout/base/nsFrameManager.cpp, line 708
	ntdll.dll!_DbgBreakPoint@0() 	
>	xpcom_core.dll!Break(const char * aMsg=0x0012f004)  Line 480	C++
 	xpcom_core.dll!NS_DebugBreak_P(unsigned int aSeverity=1, const char * aStr=0x0276aab8, const char * aExpr=0x0276aaac, const char * aFile=0x0276aa74, int aLine=708)  Line 358 + 0xc bytes	C++
 	gklayout.dll!nsFrameManager::NotifyDestroyingFrame(nsIFrame * aFrame=0x07acc9e8)  Line 708 + 0x1c bytes	C++
 	gklayout.dll!PresShell::NotifyDestroyingFrame(nsIFrame * aFrame=0x07acc9e8)  Line 2605	C++
 	gklayout.dll!nsFrame::Destroy()  Line 492	C++
 	gklayout.dll!nsSplittableFrame::Destroy()  Line 74	C++
 	gklayout.dll!nsContainerFrame::Destroy()  Line 302	C++
 	gklayout.dll!nsHTMLScrollFrame::Destroy()  Line 158	C++
 	gklayout.dll!nsFrameList::DestroyFrame(nsIFrame * aFrame=0x07acc9e8)  Line 163	C++
 	gklayout.dll!nsAbsoluteContainingBlock::RemoveFrame(nsIFrame * aDelegatingFrame=0x063494cc, nsIAtom * aListName=0x01ca9e80, nsIFrame * aOldFrame=0x07acc9e8)  Line 133 + 0xc bytes	C++
 	gklayout.dll!ViewportFrame::RemoveFrame(nsIAtom * aListName=0x01ca9e80, nsIFrame * aOldFrame=0x07acc9e8)  Line 156 + 0x17 bytes	C++
 	gklayout.dll!nsFrameManager::RemoveFrame(nsIFrame * aParentFrame=0x063494cc, nsIAtom * aListName=0x01ca9e80, nsIFrame * aOldFrame=0x07acc9e8)  Line 692	C++
 	gklayout.dll!DeletingFrameSubtree(nsFrameManager * aFrameManager=0x064527e4, nsIFrame * aFrame=0x00000000)  Line 9530	C++
 	gklayout.dll!nsCSSFrameConstructor::ContentRemoved(nsIContent * aContainer=0x061add18, nsIContent * aChild=0x065bef00, int aIndexInContainer=1, int aInReinsertContent=0)  Line 9708 + 0xd bytes	C++
etc...

Stack from the crash:
>	gklayout.dll!IsBindingAncestor(nsIContent * aContent=0xdddddddd, nsIContent * aBindingRoot=0x065ce0c0)  Line 10847 + 0x3 bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::FindFrameWithContent(nsFrameManager * aFrameManager=0x064527e4, nsIFrame * aParentFrame=0x0686ad9c, nsIContent * aParentContent=0x065ce0c0, nsIContent * aContent=0x07b52798, nsFindFrameHint * aHint=0x00000000)  Line 10952 + 0x1b bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::FindFrameWithContent(nsFrameManager * aFrameManager=0x064527e4, nsIFrame * aParentFrame=0x0686ac50, nsIContent * aParentContent=0x065ce0c0, nsIContent * aContent=0x07b52798, nsFindFrameHint * aHint=0x00000000)  Line 10961 + 0x1a bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::FindPrimaryFrameFor(nsFrameManager * aFrameManager=0x064527e4, nsIContent * aContent=0x07b52798, nsIFrame * * aFrame=0x0012e8f0, nsFindFrameHint * aHint=0x00000000)  Line 11043 + 0x21 bytes	C++
 	gklayout.dll!nsFrameManager::GetPrimaryFrameFor(nsIContent * aContent=0x07b52798, int aIndexHint=-1)  Line 395	C++
 	gklayout.dll!PresShell::GetPrimaryFrameFor(nsIContent * aContent=0x07b52798)  Line 4750	C++
 	gklayout.dll!nsElementSH::PostCreate(nsIXPConnectWrappedNative * wrapper=0x067cd380, JSContext * cx=0x05e45f18, JSObject * obj=0x0b0205c0)  Line 6983 + 0x16 bytes	C++
 	gklayout.dll!nsHTMLPluginObjElementSH::PostCreate(nsIXPConnectWrappedNative * wrapper=0x067cd380, JSContext * cx=0x05e45f18, JSObject * obj=0x0b0205c0)  Line 8659 + 0x15 bytes	C++
etc...

Comment 1

[Martijn Wargers (dead)]

Attachment: full stacks from assertion and crash

Comment 2

[Martijn Wargers (dead)]

Boris, thanks for fixing those other assertions.
Maybe you know whether this is a bad assertion? Since I seem to crash in my debug build (but not in a regular build).

Comment 3

[Mats Palmgren (inactive)]

I could reproduce this a while ago in a Windows debug build, but now
it works fine for me in up-to-date debug builds on Linux, OSX and Windows.
Martijn, can you still reproduce this?

Comment 4

[Martijn Wargers (dead)]

Indeed this has become worksforme.