Last Comment Bug 771639 - "Assertion failure: node" in ValidateCurrentNode
: "Assertion failure: node" in ValidateCurrentNode
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: DOM: Core & HTML (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla16
Assigned To: :Aryeh Gregor (away until August 15)
:
Mentors:
Depends on:
Blocks: 336383 766426
  Show dependency treegraph
 
Reported: 2012-07-06 13:25 PDT by Jesse Ruderman
Modified: 2013-04-04 13:53 PDT (History)
2 users (show)
ayg: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (575 bytes, text/html)
2012-07-06 13:25 PDT, Jesse Ruderman
no flags Details
stack trace (5.31 KB, text/plain)
2012-07-06 13:26 PDT, Jesse Ruderman
no flags Details
Patch (2.24 KB, patch)
2012-07-08 05:00 PDT, :Aryeh Gregor (away until August 15)
bugs: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2012-07-06 13:25:22 PDT
Created attachment 639769 [details]
testcase

Assertion failure: node, at content/base/src/nsRange.cpp:1457

This assertion is part of ValidateCurrentNode, a function added in bug 766426.
Comment 1 Jesse Ruderman 2012-07-06 13:26:00 PDT
Created attachment 639770 [details]
stack trace
Comment 2 :Aryeh Gregor (away until August 15) 2012-07-08 05:00:30 PDT
Created attachment 640054 [details] [diff] [review]
Patch

This turns out not to have anything to do with fullscreen.  What CutContents does in this case is:

1) Create an iterator and call Last()

2) Save the current node in a local variable

3) Call Prev() on iterator so that if we delete the local variable, the iterator points to the next node we should delete

4) Delete the node

5) Call ValidateCurrentNode() on the iterator

The problem is that if any mutation occurs in step (4), and the node we just removed is the last one, the iterator will be done.  Then ValidateCurrentNode() will try to get the current node, which will be null.  Then it will assert.  In this case, we should just say it's valid.

Try: https://tbpl.mozilla.org/?tree=Try&rev=09c3dfd3d7ce
Comment 3 :Aryeh Gregor (away until August 15) 2012-07-09 02:24:45 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/8129536fb25c
Comment 4 Ryan VanderMeulen [:RyanVM] 2012-07-09 18:05:22 PDT
https://hg.mozilla.org/mozilla-central/rev/8129536fb25c

Note You need to log in before you can comment on or make changes to this bug.