571428 - "ASSERTION: Can't be unbound without being bound originally"

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: Can't be unbound without being bound originally: 'mBoundFrame', file /builds/moz2_slave/mozilla-central-macosx-debug/build/content/html/content/src/nsTextEditorState.cpp, line 1326

More fallout from bug 534785, maybe?

Comment 1

[(no longer active)]

(In reply to comment #0)
> More fallout from bug 534785, maybe?

Looks like it.

Comment 2

[(no longer active)]

Attachment: Patch (v1)

What's happening here is that we change the type, which causes us to free our nsTextEditorState object, then change the type back to text again, which allocates a new nsTextEditorState object.  After this, the original frame gets destroyed, and it asserts when it tries to unbind itself from the nsTextEditorState object, because that object has gone away for a long time.

The only way that I could think of to fix it is to unbind the frame (if there's any) before the nsTextEditorState object is freed.  The code doesn't look that clean to me, though.  Is there a better way to fix this?

Comment 3

[(no longer active)]

Attachment: Patch (v1.1)

Let's make HasBoundFrame non-inline so that every file which #includes nsTextEditorState.h shouldn't have to #include nsTextControlFrame.h as well.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Why not just make nsTextEditorState::UnbindFromFrame check HasBoundFrame internally, and call UnbindFromFrame from nsHTMLInputElement::FreeData?

Comment 5

[(no longer active)]

Attachment: Patch (v2)

Comment 6

[(no longer active)]

http://hg.mozilla.org/mozilla-central/rev/a0f03aecadef