515829 - "ASSERTION: How can we have a null mDefaultSubmitElement but a first-submit slot in one of the lists?", crash [@ CompareFormControlPosition]

Status: RESOLVED FIXED

(Core :: Layout: Form Controls, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: How can we have a null mDefaultSubmitElement but a first-submit slot in one of the lists?: '*firstSubmitSlot == mDefaultSubmitElement || mDefaultSubmitElement', file /Users/jruderman/central/content/html/content/src/nsHTMLFormElement.cpp, line 1438

###!!! ASSERTION: We should be able to QI to nsIContent here!: 'content1 && content2', file /Users/jruderman/central/content/html/content/src/nsHTMLFormElement.cpp, line 1298

###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsCOMPtr.h, line 796

Comment 1

[Martijn Wargers (dead)]

Works for me, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a1pre) Gecko/20090910 Minefield/3.7a1pre (.NET CLR 3.5.30729)

Comment 2

[Boris Zbarsky [:bzbarsky]]

Regression from bug 513153.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Oh, and this is only hit if the default submit is removed and then added as part of the same update.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

Comment 5

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/mozilla-central/rev/dec9bfcc8de5