718282 - "ASSERTION: Please remove this from the document properly" or leak nsDocument+

Status: NEW

(Core :: DOM: Editor, defect, P5)

Description

[Jesse Ruderman]

Attachment: testcase

1. Install https://www.squarefree.com/extensions/domFuzzLite3.xpi if you want the forced CC to work.
2. Load the testcase (in a debug build with XPCOM_MEM_LEAK_LOG=2).
3. Quit Firefox.

Without the forced CC:

###!!! ASSERTION: Please remove this from the document properly: '!IsInDoc()', file content/base/src/nsGenericElement.cpp, line 2342

With the forced CC:

Leak nsDocument+

Comment 1

[(no longer active)]

This is yet another bug caused by the broken way in which we implement our table editing UI.  When the entire content subtree is removed from the document, the anchor elements we use for the table editing UI will not be notified, so they will think that they're still in the document when they're being destroyed.

Comment 2

[Jens Stutte [:jstutte]]

Bulk-downgrade of unassigned, >=5 years untouched DOM/Storage bugs' priority and severity.

If you have reason to believe this is wrong, please write a comment and ni :jstutte.