Last Comment Bug 714587 - "ASSERTION: unexpected disconnected nodes" with full screen, selectAllChildren
: "ASSERTION: unexpected disconnected nodes" with full screen, selectAllChildren
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: DOM: Core & HTML (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla12
Assigned To: Mats Palmgren (:mats)
:
: Andrew Overholt [:overholt]
Mentors:
Depends on:
Blocks: 326633
  Show dependency treegraph
 
Reported: 2012-01-02 00:20 PST by Jesse Ruderman
Modified: 2013-04-04 13:53 PDT (History)
6 users (show)
mats: in‑testsuite?
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (375 bytes, text/html)
2012-01-02 00:20 PST, Jesse Ruderman
no flags Details
fix (1.10 KB, patch)
2012-01-03 04:59 PST, Mats Palmgren (:mats)
bugs: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2012-01-02 00:20:41 PST
Created attachment 585257 [details]
testcase

Sometimes, this testcase causes an assertion during shutdown. Moving the mouse while Firefox enters full-screen might make it more likely.

###!!! ASSERTION: unexpected disconnected nodes: 'mIsDetached', file content/base/src/nsRange.cpp, line 796

nsRange::Reset [content/base/src/nsRange.cpp:839]
nsRange::cycleCollection::Unlink [content/base/src/nsRange.cpp:347]
nsCycleCollector::CollectWhite [xpcom/base/nsCycleCollector.cpp:2145]
nsCycleCollector::FinishCollection [xpcom/base/nsCycleCollector.cpp:2973]
nsCycleCollector::Collect [xpcom/base/nsCycleCollector.cpp:2821]
nsCycleCollector::Shutdown [xpcom/base/nsCycleCollector.cpp:3049]
nsCycleCollector_shutdown [xpcom/base/nsCycleCollector.cpp:3764]
mozilla::ShutdownXPCOM [xpcom/build/nsXPComInit.cpp:672]
ScopedXPCOMStartup::~ScopedXPCOMStartup [toolkit/xre/nsAppRunner.cpp:1114]
XRE_main [nsCOMPtr.h:809]
main [browser/app/nsBrowserApp.cpp:201]
Comment 1 Mats Palmgren (:mats) 2012-01-02 05:39:00 PST
http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsRange.cpp#779
this assertion can only occur if IsInSelection() is true.   We need to make
sure the range is removed from the Selection before Unlink is called.
Comment 2 Mats Palmgren (:mats) 2012-01-03 04:59:48 PST
Created attachment 585382 [details] [diff] [review]
fix

I guess I thought the nsTypedSelection UNLINK handler would be called
before the nsRange's (since there is a strong pointer from the
selection to the range), but I guess my assumption was wrong and that
there is no guaranteed ordering of these calls.
http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsSelection.cpp#3438
http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsRange.cpp#345
Comment 3 Andrew McCreight [:mccr8] 2012-01-03 08:59:04 PST
(In reply to Mats Palmgren [:mats] from comment #2)
> I guess I thought the nsTypedSelection UNLINK handler would be called
> before the nsRange's (since there is a strong pointer from the
> selection to the range), but I guess my assumption was wrong and that
> there is no guaranteed ordering of these calls.
The CC computes everything that is dead in a single go, which can include something and the things that it strongly holds.  If two things are identified as garbage in a single CC, then the order their unlinks are called in is arbitrary.
Comment 5 Joe Drew (not getting mail) 2012-01-28 18:51:19 PST
https://hg.mozilla.org/mozilla-central/rev/0529bd4e33bd

Note You need to log in before you can comment on or make changes to this bug.