Closed Bug 574898 Opened 14 years ago Closed 14 years ago

"ASSERTION: called nsGenericElement::SetText" with spellcheck

Categories

(Core :: Layout: Form Controls, defect)

Product:
Core
Component:
Layout: Form Controls
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla2.0b1

People

(Reporter: jruderman, Assigned: ehsan.akhgari)

References

Details

(Keywords: assertion, testcase)

Attachments

(3 files, 1 obsolete file)

stack trace
9.85 KB, text/plain
Details
simpler testcase
228 bytes, text/html
Details
Patch (v1)
2.51 KB, patch
roc
: review+
Details | Diff | Splinter Review
Attached file testcase (obsolete) — 
Same assertion as in bug 570624, which ehsan fixed.

###!!! ASSERTION: called nsGenericElement::SetText: 'Error', file content/base/src/nsGenericElement.cpp, line 4953
Attached file stack trace — 

    
    

    
  
The iframe in this test case doesn't have any significance.

Jesse, I always thought that your fuzzing framework creates minimized test cases.  Is that true?  You may want to look into why this iframe remained in the generated test case.

    
    

    
  

      
      
      
      

        Attached file
          
        simpler testcase
        — 
      

    


  

        Attachment #454214 -
        Attachment is obsolete: true

    
  
Summary: "ASSERTION: called nsGenericElement::SetText" with spellcheck, iframe → "ASSERTION: called nsGenericElement::SetText" with spellcheck

    
    

    
  

      
      
      
      

        Attached patch
          
          
        Patch (v1)
        — 
          — Splinter Review
      

    


  
The cause of the assertion was that the text control frame did not initialize its editor link for spellcheck attributes in nsTextControlFrame::AttributeChanged, but the content node did, which caused the frame and content node have an inconsistent state.
Assignee: nobody → ehsan
Status: NEW → ASSIGNED

        Attachment #454438 -
        Flags: review?(roc)

    
    

    
  
(In reply to comment #3)
> Created an attachment (id=454437) [details]
> simpler testcase

Thanks, but I just wanted to point this out for your attention in case this is something to fix in the fuzzer itself!  :-)

    
    

    
  
http://hg.mozilla.org/mozilla-central/rev/943573c4f051
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.3b1

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: