406904 - Crash [@ VerifySameTree] with XBL

Status: RESOLVED FIXED

(Core :: XBL, defect, P3)

Description

[Jesse Ruderman]

Attachment: testcase 1 (crashes firefox when loaded)

Loading testcase 1 triggers:

###!!! ASSERTION: SetMayHaveFrame failed?: 'mContent->MayHaveFrame()', file /Users/jruderman/trunk/mozilla/layout/generic/nsFrame.cpp, line 409
frame: Text(-1) (0x2490020) style: 0x248e108 :-moz-non-element {}
###!!! ASSERTION: Wrong parent style context: 'Error', file /Users/jruderman/trunk/mozilla/layout/base/nsFrameManager.cpp, line 822
Wrong parent style context: should be using:  style: 0x248e2a8 {}

Crash [@ VerifySameTree] [@ nsStyleContext::GetParent].

Comment 1

[Jesse Ruderman]

Attachment: testcase 2

This testcase only triggers:

###!!! ASSERTION: element not in the document: 'doc', file /Users/jruderman/trunk/mozilla/layout/base/nsChildIterator.cpp, line 62

The difference between testcase 1 and testcase 2 is that a text node in the XBL binding has been replaced with an empty span element.

Comment 2

[Jesse Ruderman]

Related to bug 342954?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Yes, indeed.  And my patch for that bug fixes these testcases, incidentally.  ;)

Comment 4

[Johnny Stenback (:jst)]

Is this fixed now that bug 342954 has landed? Feel free to renominate if not.

Comment 5

[Boris Zbarsky [:bzbarsky]]

I think it should be fixed.  Jesse, could you retest, and land the tests as needed?

Comment 6

[Jesse Ruderman]

I retested and everything seems happy.  Crashtests checked in.