572003 - Crash [@ nsContentUtils::ContentIsDescendantOf] with xul:menuitem, xul:popup

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Comment 1

[Jesse Ruderman]

Attachment: crash report from mac os x crash reporter

Comment 2

[Jesse Ruderman]

Before the crash, I get:

###!!! ASSERTION: not in child list: 'found', file layout/base/nsLayoutUtils.cpp, line 278

###!!! ASSERTION: unexpected child list: 'Error', file layout/generic/nsBlockFrame.cpp, line 4928

###!!! ASSERTION: Why did we get called?: '!aChildContent->GetPrimaryFrame() || !aState.mSetPrimaryFrames || aChildContent->GetPrimaryFrame()->GetContent() != aChildContent', file layout/base/nsCSSFrameConstructor.cpp, line 2190

###!!! ASSERTION: identical: 'pseudoType1 != pseudoType2', file layout/base/nsGenConList.cpp, line 136

###!!! ASSERTION: identical: 'pseudoType1 != pseudoType2', file layout/base/nsGenConList.cpp, line 136

###!!! ASSERTION: Losing track of existing primary frame: '!aFrame || !mPrimaryFrame || aFrame == mPrimaryFrame', file ../../dist/include/nsIContent.h, line 875

###!!! ASSERTION: null check on startContent should be sufficient to null check nodeContent as well, since if nodeContent is for the root, startContent (which is before it) must be too: 'nodeContent || !startContent', file layout/base/nsCounterManager.cpp, line 165

###!!! ASSERTION: The possible descendant is null!: 'aPossibleDescendant', file content/base/src/nsContentUtils.cpp, line 1441

Comment 3

[Mats Palmgren (inactive)]

The patch in bug 536720 fixes this and includes the test here.

Comment 4

[Mats Palmgren (inactive)]

Fixed by bug 536720.