ASSERTION: GetPrimaryFrameFor() called while frames are being destroyed!: '!mIsDestroyingFrames'

RESOLVED FIXED

Status

()

Core
XUL
RESOLVED FIXED
9 years ago
3 years ago

People

(Reporter: mats, Unassigned)

Tracking

({assertion})

Trunk
x86
Linux
assertion
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:investigate])

Attachments

(2 attachments)

(Reporter)

Description

9 years ago
I've just added this assertion in bug 458636.
I triggers when loading the mochitest:
content/tests/widgets/test_popupremoving.xul

###!!! ASSERTION: GetPrimaryFrameFor() called while frames are being destroyed!: '!mIsDestroyingFrames', file /usr/moz/hg3/layout/base/nsFrameManager.cpp, line 328

This usually means there's a path to a bad crash (using freed frames or such).
I don't know if that's the case here or if it's harmless, but I'm filing
the bug as security-sensitive just in case.
(Reporter)

Comment 1

9 years ago
Created attachment 342816 [details]
stack for the GetPrimaryFrameFor() assertion
(Reporter)

Comment 2

9 years ago
Created attachment 342817 [details]
stack for the "killing mutation events" assertion

test_popupremoving.xul also triggers:

ASSERTION: killing mutation events: 'nsContentUtils::IsSafeToRunScript()', file ../../../dist/include/content/nsContentUtils.h, line 1512

Here's the stack for that assertion.
(Reporter)

Updated

9 years ago
Attachment #342816 - Attachment description: stack for theGetPrimaryFrameFor() assertion → stack for the GetPrimaryFrameFor() assertion
Whiteboard: [sg:investigate]
(Reporter)

Updated

9 years ago
Assignee: jag → nobody

Updated

9 years ago
Blocks: 404077

Comment 3

8 years ago
> ###!!! ASSERTION: GetPrimaryFrameFor() called while frames are being
> destroyed!: '!mIsDestroyingFrames', file
> /usr/moz/hg3/layout/base/nsFrameManager.cpp, line 328

This assertion was removed in rev e9921507713b:
user:        Boris Zbarsky
date:        Thu Dec 24 16:20:06 2009 -0500
summary:     Bug 500882 part 7.  Remove the old GetPrimaryFrameFor API.  r=roc, sr=dbaron
Yeah, that bug's fix got rid of the whole class of "dangling frame pointer mapped to a content node" issues.

Comment 5

8 years ago
test_popupremoving doesn't trigger any assertions now :)

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268460426.1268461747.4378.gz&fulltext=1
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
Group: core-security
You need to log in before you can comment on or make changes to this bug.