Last Comment Bug 754046 - "ASSERTION: mRequiredRadioCount about to wrap below 0!" with radio root
: "ASSERTION: mRequiredRadioCount about to wrap below 0!" with radio root
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: DOM: Core & HTML (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla15
Assigned To: Mounir Lamouri (:mounir)
:
Mentors:
Depends on:
Blocks: 594645
  Show dependency treegraph
 
Reported: 2012-05-10 14:23 PDT by Jesse Ruderman
Modified: 2012-05-15 06:46 PDT (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (82 bytes, application/xhtml+xml)
2012-05-10 14:23 PDT, Jesse Ruderman
no flags Details
stack trace (2.83 KB, text/plain)
2012-05-10 14:24 PDT, Jesse Ruderman
no flags Details
Patch v1 (1.30 KB, patch)
2012-05-11 11:34 PDT, Mounir Lamouri (:mounir)
bzbarsky: review-
Details | Diff | Review
Patch (1.32 KB, patch)
2012-05-12 08:47 PDT, Mounir Lamouri (:mounir)
bzbarsky: review+
mounir: checkin+
Details | Diff | Review

Description Jesse Ruderman 2012-05-10 14:23:58 PDT
Created attachment 622918 [details]
testcase

1. Load the testcase.
2. Quit Firefox.

Result: An assertion fails during cycle collection.

###!!! ASSERTION: mRequiredRadioCount about to wrap below 0!: 'radioGroup->mRequiredRadioCount != 0', file content/base/src/nsDocument.cpp, line 6617

This is a "regression" from bug 750370 (before which the assertion was a noop).
Comment 1 Jesse Ruderman 2012-05-10 14:24:11 PDT
Created attachment 622919 [details]
stack trace
Comment 2 Mounir Lamouri (:mounir) 2012-05-11 11:34:17 PDT
Created attachment 623232 [details] [diff] [review]
Patch v1

I have no idea why |GetParent()| was checked before.

Unfortunately, we need to trigger the GC to write a test and the only tests that would fail with asserts are reftests/crashtests which don't allow GC to be triggered AFAIK.
Comment 3 Boris Zbarsky [:bz] 2012-05-11 22:03:41 PDT
Comment on attachment 623232 [details] [diff] [review]
Patch v1

This patch just rearranges the comments and moves the 'notify' init.  Based on comment 2. shouldn't something happen here with GetParent() ?
Comment 4 Mounir Lamouri (:mounir) 2012-05-12 08:47:27 PDT
Created attachment 623434 [details] [diff] [review]
Patch

Arg... I changed the patch to see what I could do to test it and I forgot to revert that change.

This is the real patch I wanted to attach ;)
Comment 5 Boris Zbarsky [:bz] 2012-05-12 19:52:46 PDT
Comment on attachment 623434 [details] [diff] [review]
Patch

That makes way more sense.  r=me
Comment 6 Ed Morley [:emorley] 2012-05-15 06:46:00 PDT
https://hg.mozilla.org/mozilla-central/rev/89be81f8a5c7

Note You need to log in before you can comment on or make changes to this bug.