429088 - "ASSERTION: killing mutation events" with generated content

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P2)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: killing mutation events: 'nsContentUtils::IsSafeToRunScript()', file ../../../dist/include/content/nsContentUtils.h, line 1444

This assertion is part of a function added in bug 423355.  Does it indicate a bug in the patch for bug 423355 or a bug in the MathML code?

Comment 1

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

It's indicating a bug in the MathML code. It's likely calling SetAttr with aNotify=true during reflow or frame creation.

Note that with the patch in bug 423355 this bug manifests itself not as us firing an unsafe mutation event, but rather as us missing to fire a mutation event.

Comment 2

[Jesse Ruderman]

Attachment: stack trace

Seems to implicate generated content code rather than MathML code.

Comment 3

[Jesse Ruderman]

Attachment: testcase without MathML

Comment 4

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Hmm.. strange, this is the callsite i mentioned in bug 429175, but I didn't think it would actually fire this assertion since there couldn't possibly be any mutation listeners since the node is newly created.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

It is because of DOMSubtreeModified, which is batched. So there "might be" a
listener for the final mutation collection.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

So perhaps the assertion shouldn't really assert always.

Comment 7

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Oh, now I know why I don't assert. Because my build has that callsite set to not notify.

Comment 8

[Jesse Ruderman]

WFM.  I checked both testcases in as crashtests.