822776 - "Assertion failure: fragment" with <frameset>

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

Assertion failure: fragment, at parser/html/nsHtml5TreeBuilder.cpp:2686

(Not to be confused with bug 797009, which is the opposite assertion, somewhere else in the code.)

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Jesse Ruderman]

Slightly different on trunk:

Assertion failure: fragment || isTemplateContents(), at parser/html/nsHtml5TreeBuilder.cpp:2848

Comment 3

[Jesse Ruderman]

Attachment: testcase 2

Comment 4

[Bob Clary [:bc] (inactive)]

Assertion failure: fragment Beta/21
Assertion failure: fragment || isTemplateContents() Aurora/22, Nightly/23
Windows, Linux, OSX

http://www.wellensittich.net/   (reduces to the same testcase)

http://www.revistadoutrina.trf4.jus.br/index.htm?http://www.revistadoutrina.trf4.jus.br/artigos/edicao014/Daniela_Gomes.htm

Comment 5

[William Chen [:wchen]]

Attachment: Update "after after framset" insertion mode.

This assertion failure seems to happen because we do the wrong thing in the "after after frameset" insertion mode.

http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#the-after-after-frameset-insertion-mode

In particular, the current code sets the insertion mode to "in frameset" when the spec says to ignore end tags. I also noticed that we handle the "noframes" case incorrectly so I've fixed that as well.

Comment 6

[Henri Sivonen (:hsivonen)]

Comment on attachment 829649 [details] [diff] [review]
Update "after after framset" insertion mode.

Could use a test case addition to the html5lib test cases.

Comment 7

[William Chen [:wchen]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e2cd9042e2ad

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/e2cd9042e2ad