Last Comment Bug 726364 - "ASSERTION: unexpected disconnected nodes" with range, splitText, mutation event
: "ASSERTION: unexpected disconnected nodes" with range, splitText, mutation event
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: DOM: Core & HTML (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla13
Assigned To: Mats Palmgren (:mats)
:
: Andrew Overholt [:overholt]
Mentors:
Depends on:
Blocks: 336383
  Show dependency treegraph
 
Reported: 2012-02-11 14:24 PST by Jesse Ruderman
Modified: 2013-04-04 13:53 PDT (History)
7 users (show)
mats: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (465 bytes, text/html)
2012-02-11 14:24 PST, Jesse Ruderman
no flags Details
stack (12.61 KB, text/plain)
2012-02-11 16:53 PST, Mats Palmgren (:mats)
no flags Details
fix (1.11 KB, patch)
2012-02-11 16:59 PST, Mats Palmgren (:mats)
bugs: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2012-02-11 14:24:13 PST
Created attachment 596386 [details]
testcase

###!!! ASSERTION: unexpected disconnected nodes: 'aDisconnected', file content/base/src/nsContentUtils.cpp, line 1716

nsRange::SetEnd [content/base/src/nsRange.cpp:1004]
nsRange::SetEnd [content/base/src/nsRange.cpp:987]
nsIDOMRange_SetEnd [obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:17981]
js::CallJSNative [js/src/jscntxtinlines.h:311]
...
Comment 1 Mats Palmgren (:mats) 2012-02-11 16:53:17 PST
Created attachment 596405 [details]
stack
Comment 2 Mats Palmgren (:mats) 2012-02-11 16:59:29 PST
Created attachment 596406 [details] [diff] [review]
fix

I don't think we want to run script before we have inserted
the new node.  There's a similar case in 
nsINode::Normalize()
  nsTextNode::AppendTextForNormalize
    SetTextInternal
  RemoveChildAt

where Normalize() use mozAutoDocUpdate to batch those events.

This patch makes SplitData have the same setup.
Comment 3 Mats Palmgren (:mats) 2012-02-11 17:00:34 PST
https://tbpl.mozilla.org/?tree=Try&rev=751dc0721e3f
Comment 4 Olli Pettay [:smaug] 2012-02-11 17:01:52 PST
Comment on attachment 596406 [details] [diff] [review]
fix

What if there is no current document?
Comment 5 Olli Pettay [:smaug] 2012-02-11 17:02:28 PST
Would adding a scriptblocker work?
Comment 6 Mats Palmgren (:mats) 2012-02-11 18:25:51 PST
> What if there is no current document?

mozAutoDocUpdate deals with that:
http://mxr.mozilla.org/mozilla-central/source/content/base/src/mozAutoDocUpdate.h#51

> Would adding a scriptblocker work?

Well, we are modifying the DOM so wrapping the changes in BeginUpdate/EndUpdate
seems prudent.  I don't much about the nsIDocumentObserver protocol though...
Comment 7 Boris Zbarsky [:bz] (still a bit busy) 2012-02-11 20:34:09 PST
It's ... been changing. I do think doing the update here is the prudent thing.
Comment 8 Olli Pettay [:smaug] 2012-02-12 04:20:05 PST
Comment on attachment 596406 [details] [diff] [review]
fix

Ok
Comment 10 Phil Ringnalda (:philor) 2012-02-12 14:18:04 PST
Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/0c1fdf386ac1 since I wasn't sure which reftest failures and which crashtest assertion count failures went with which cset in the push.
Comment 12 Marco Bonardo [::mak] 2012-02-14 02:35:19 PST
https://hg.mozilla.org/mozilla-central/rev/5c8d7e3de1b8

Note You need to log in before you can comment on or make changes to this bug.