Closed Bug 427691 Opened 16 years ago Closed 16 years ago

"ASSERTION: Bad count" adding script during mutation event

Categories

(Core :: DOM: Core & HTML, defect, P1)

x86
macOS
defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: jruderman, Assigned: sicking)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(2 files)

Attached file testcase
Loading the testcase triggers:

###!!! ASSERTION: Bad count: 'lastBlocker == sBlockedScriptRunners->Count() && sRunnersCountAtFirstBlocker == 0', file /Users/jruderman/trunk/mozilla/content/base/src/nsContentUtils.cpp, line 4027

Then, shutting down Firefox triggers:

###!!! ASSERTION: How'd this happen?: '!sBlockedScriptRunners || sBlockedScriptRunners->Count() == 0', file /Users/jruderman/trunk/mozilla/content/base/src/nsContentUtils.cpp, line 831

This happens both without and with the patch in bug 423355 comment 39.

I'm filing this as security-sensitive out of caution, since the assertion involves code added in bug 423355, which is security-sensitive.
Flags: blocking1.9?
> I'm filing this as security-sensitive out of caution, since the assertion
> involves code added in bug 423355, which is security-sensitive.

I meant bug 401155.
Why should this block 1.9 in particular?  Could we take this in a dot release?

re-nom if necessary.
Flags: wanted1.9.0.x+
Flags: blocking1.9?
Flags: blocking1.9-
It's a recent regression of a security-related invariant.  Jonas needs to decide whether the reason the assertion is firing is bad enough to need fixing in 1.9.0, basically...  That evaluation we should definitely block on.
Flags: blocking1.9- → blocking1.9?
I'll look into this.
Flags: blocking1.9? → blocking1.9+
This sounds like it's a really scary state, but it's something we can fix in a dot-release.
Assignee: nobody → jonas
Flags: blocking1.9+ → blocking1.9-
Priority: -- → P1
I'm unable to reproduce this on windows. Mac-only or fixed?
I can no longer reproduce this bug.
Flags: in-testsuite?
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → WORKSFORME
Flags: wanted1.9.0.x-
Flags: wanted1.9.0.x+
Flags: wanted1.8.1.x?
Group: core-security → core-security-release
Group: core-security-release
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: