698224 - ###!!! ASSERTION: Losing track of existing primary frame

Status: NEW

(Core :: Layout: Images, Video, and HTML Frames, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

Attachment: testcase

###!!! ASSERTION: Losing track of existing primary frame: '!aFrame || !mPrimaryFrame || aFrame == mPrimaryFrame', file ../../dist/include/nsIContent.h, line 890

I'm not yet sure if this case causes security problems.

We really need to fix imagemap handling.
In this case just not-supporting <a> in <map> would be enough.
(Per html4 map can contain a, but html5 has removed that.)

Comment 1

[Boris Zbarsky [:bzbarsky]]

Ah, so the only reason we don't hit this for <area> is that we make those "display:none !imporant" in html.css, right?

I would be just fine with dropping support for <a> in <map>.

Comment 2

[Johnny Stenback (:jst)]

bz, any thoughts on security rating for this?

Comment 3

[Boris Zbarsky [:bzbarsky]]

I'm not sure there's an actual security issue here....  We don't lose the frame from the frame tree or anything like that.

Comment 4

[Johnny Stenback (:jst)]

Opening this bug up then. Thanks bz!