754046 - "ASSERTION: mRequiredRadioCount about to wrap below 0!" with radio root

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase

1. Load the testcase.
2. Quit Firefox.

Result: An assertion fails during cycle collection.

###!!! ASSERTION: mRequiredRadioCount about to wrap below 0!: 'radioGroup->mRequiredRadioCount != 0', file content/base/src/nsDocument.cpp, line 6617

This is a "regression" from bug 750370 (before which the assertion was a noop).

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Mounir Lamouri (:mounir)]

Attachment: Patch v1

I have no idea why |GetParent()| was checked before.

Unfortunately, we need to trigger the GC to write a test and the only tests that would fail with asserts are reftests/crashtests which don't allow GC to be triggered AFAIK.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 623232 [details] [diff] [review]
Patch v1

This patch just rearranges the comments and moves the 'notify' init.  Based on comment 2. shouldn't something happen here with GetParent() ?

Comment 4

[Mounir Lamouri (:mounir)]

Attachment: Patch

Arg... I changed the patch to see what I could do to test it and I forgot to revert that change.

This is the real patch I wanted to attach ;)

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 623434 [details] [diff] [review]
Patch

That makes way more sense.  r=me

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/89be81f8a5c7