726364 - "ASSERTION: unexpected disconnected nodes" with range, splitText, mutation event

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: unexpected disconnected nodes: 'aDisconnected', file content/base/src/nsContentUtils.cpp, line 1716

nsRange::SetEnd [content/base/src/nsRange.cpp:1004]
nsRange::SetEnd [content/base/src/nsRange.cpp:987]
nsIDOMRange_SetEnd [obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:17981]
js::CallJSNative [js/src/jscntxtinlines.h:311]
...

Comment 1

[Mats Palmgren (inactive)]

Attachment: stack

Comment 2

[Mats Palmgren (inactive)]

Attachment: fix

I don't think we want to run script before we have inserted
the new node.  There's a similar case in 
nsINode::Normalize()
  nsTextNode::AppendTextForNormalize
    SetTextInternal
  RemoveChildAt

where Normalize() use mozAutoDocUpdate to batch those events.

This patch makes SplitData have the same setup.

Comment 3

[Mats Palmgren (inactive)]

https://tbpl.mozilla.org/?tree=Try&rev=751dc0721e3f

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 596406 [details] [diff] [review]
fix

What if there is no current document?

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Would adding a scriptblocker work?

Comment 6

[Mats Palmgren (inactive)]

> What if there is no current document?

mozAutoDocUpdate deals with that:
http://mxr.mozilla.org/mozilla-central/source/content/base/src/mozAutoDocUpdate.h#51

> Would adding a scriptblocker work?

Well, we are modifying the DOM so wrapping the changes in BeginUpdate/EndUpdate
seems prudent.  I don't much about the nsIDocumentObserver protocol though...

Comment 7

[Boris Zbarsky [:bzbarsky]]

It's ... been changing. I do think doing the update here is the prudent thing.

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 596406 [details] [diff] [review]
fix

Ok

Comment 9

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8a820e4ee7f6

Comment 10

[Phil Ringnalda (:philor)]

Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/0c1fdf386ac1 since I wasn't sure which reftest failures and which crashtest assertion count failures went with which cset in the push.

Comment 11

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5c8d7e3de1b8

Comment 12

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/5c8d7e3de1b8