Created attachment 315715 [details] testcase ###!!! ASSERTION: killing mutation events: 'nsContentUtils::IsSafeToRunScript()', file ../../../dist/include/content/nsContentUtils.h, line 1444 This assertion is part of a function added in bug 423355. Does it indicate a bug in the patch for bug 423355 or a bug in the MathML code?
It's indicating a bug in the MathML code. It's likely calling SetAttr with aNotify=true during reflow or frame creation. Note that with the patch in bug 423355 this bug manifests itself not as us firing an unsafe mutation event, but rather as us missing to fire a mutation event.
Created attachment 315828 [details] stack trace Seems to implicate generated content code rather than MathML code.
Hmm.. strange, this is the callsite i mentioned in bug 429175, but I didn't think it would actually fire this assertion since there couldn't possibly be any mutation listeners since the node is newly created.
It is because of DOMSubtreeModified, which is batched. So there "might be" a listener for the final mutation collection.
So perhaps the assertion shouldn't really assert always.
Oh, now I know why I don't assert. Because my build has that callsite set to not notify.
Assignee: nobody → jonas
Priority: -- → P2
WFM. I checked both testcases in as crashtests.
Assignee: jonas → nobody
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Component: MathML → Layout
QA Contact: mathml → layout
Resolution: --- → WORKSFORME
Summary: "ASSERTION: killing mutation events" with <math:ms> → "ASSERTION: killing mutation events" with generated content
You need to log in before you can comment on or make changes to this bug.