"ASSERTION: killing mutation events" with generated content

RESOLVED WORKSFORME

Status

()

P2
normal
RESOLVED WORKSFORME
11 years ago
10 years ago

People

(Reporter: jruderman, Unassigned)

Tracking

(Blocks: 3 bugs, {assertion, testcase})

Trunk
x86
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
wanted1.9.1 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

11 years ago
Created attachment 315715 [details]
testcase

###!!! ASSERTION: killing mutation events: 'nsContentUtils::IsSafeToRunScript()', file ../../../dist/include/content/nsContentUtils.h, line 1444

This assertion is part of a function added in bug 423355.  Does it indicate a bug in the patch for bug 423355 or a bug in the MathML code?
(Reporter)

Updated

11 years ago
Blocks: 423355
It's indicating a bug in the MathML code. It's likely calling SetAttr with aNotify=true during reflow or frame creation.

Note that with the patch in bug 423355 this bug manifests itself not as us firing an unsafe mutation event, but rather as us missing to fire a mutation event.
(Reporter)

Comment 2

11 years ago
Created attachment 315828 [details]
stack trace

Seems to implicate generated content code rather than MathML code.
(Reporter)

Comment 3

11 years ago
Created attachment 315829 [details]
testcase without MathML
Hmm.. strange, this is the callsite i mentioned in bug 429175, but I didn't think it would actually fire this assertion since there couldn't possibly be any mutation listeners since the node is newly created.

Comment 5

11 years ago
It is because of DOMSubtreeModified, which is batched. So there "might be" a
listener for the final mutation collection.

Comment 6

11 years ago
So perhaps the assertion shouldn't really assert always.
Oh, now I know why I don't assert. Because my build has that callsite set to not notify.
Assignee: nobody → jonas
Flags: wanted1.9.1+
Priority: -- → P2
(Reporter)

Comment 8

10 years ago
WFM.  I checked both testcases in as crashtests.
Assignee: jonas → nobody
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Component: MathML → Layout
Flags: in-testsuite+
QA Contact: mathml → layout
Resolution: --- → WORKSFORME
Summary: "ASSERTION: killing mutation events" with <math:ms> → "ASSERTION: killing mutation events" with generated content
You need to log in before you can comment on or make changes to this bug.