458637 - [FIX]"ASSERTION: unexpected second call to SetInitialChildList" and more with XSLT

Status: RESOLVED FIXED

(Core :: XSLT, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
1. Save the attachments as b3.html and inner.xhtml
2. Open b3.html

Result:

###!!! ASSERTION: initial containing block already created: 'nsnull == mInitialContainingBlock', file /Users/jruderman/central/layout/base/nsCSSFrameConstructor.cpp, line 8745

###!!! ASSERTION: unexpected second call to SetInitialChildList: 'Not Reached', file /Users/jruderman/central/layout/generic/nsContainerFrame.cpp, line 111

###!!! ASSERTION: Some objects allocated with AllocateFrame were not freed: 'mFrameCount == 0', file /Users/jruderman/central/layout/base/nsPresShell.cpp, line 676

Security-sensitive for now because the last assertion scares me.

Based on the crashtest for bug 428844.  Related to bug 61675?

Comment 1

[Jesse Ruderman]

Attachment: b3.html

Comment 2

[Jesse Ruderman]

Attachment: inner.xhtml

Comment 3

[Boris Zbarsky [:bzbarsky]]

So the issue is that we swap in the new document into the viewer while the subframe is hidden.  Then we do a BeginUpdate() before inserting the root content, which processes restyles and unhides the subframe.  Since we didn't flag the transformation result as not being ready for initial reflow yet, the document viewer does said initial reflow.  Then we insert the root, which effectively double-notifies on it, hence the asserts.

Fix coming up.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Please check in as a crashtest (hopefully crashtests will one day fail on assertions)

Comment 6

[Boris Zbarsky [:bzbarsky]]

Pushed changeset 95e6729d8079.  I didn't check in the test yet, because this is still security-sensitive.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 342382 [details] [diff] [review]
Fix

Simple fix; should take on branch.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 342382 [details] [diff] [review]
Fix

Approved for 1.9.0.4, a=dveditz for release-drivers

Comment 9

[Boris Zbarsky [:bzbarsky]]

Fixed for 1.9.0.4.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Tomcat, could you verify this one for 1.9.0.4 as well since you have a debug build?

Comment 11

[Carsten Book [:Tomcat]]

verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.4pre) Gecko/2008102800 Firefox/3.0.4pre - i don't see the assertion from comment #0 when using the testcase from Jesse.

--> Verified fixed1.9.04