Created attachment 585257 [details]
Sometimes, this testcase causes an assertion during shutdown. Moving the mouse while Firefox enters full-screen might make it more likely.
###!!! ASSERTION: unexpected disconnected nodes: 'mIsDetached', file content/base/src/nsRange.cpp, line 796
this assertion can only occur if IsInSelection() is true. We need to make
sure the range is removed from the Selection before Unlink is called.
Created attachment 585382 [details] [diff] [review]
I guess I thought the nsTypedSelection UNLINK handler would be called
before the nsRange's (since there is a strong pointer from the
selection to the range), but I guess my assumption was wrong and that
there is no guaranteed ordering of these calls.
(In reply to Mats Palmgren [:mats] from comment #2)
> I guess I thought the nsTypedSelection UNLINK handler would be called
> before the nsRange's (since there is a strong pointer from the
> selection to the range), but I guess my assumption was wrong and that
> there is no guaranteed ordering of these calls.
The CC computes everything that is dead in a single go, which can include something and the things that it strongly holds. If two things are identified as garbage in a single CC, then the order their unlinks are called in is arbitrary.