837031 - "ASSERTION: DropReference not called" after accessing child cssRule

Status: RESOLVED FIXED

(Core :: DOM: CSS Object Model, defect)

Description

[Jesse Ruderman]

Attachment: testcase

1. Load the testcase
2. Close the testcase, then force a cycle collection.  (Or just quit the browser.)

###!!! ASSERTION: DropReference not called.: '!mRule', file layout/style/nsCSSRules.cpp, line 1930

Comment 1

[Jesse Ruderman]

Attachment: stack (with CC triggered from about:memory)

Comment 2

[Boris Zbarsky [:bzbarsky]]

This is a regression from bug 774980.  The problem is that we unlink the objects now, so the DropReference call in ~nsCSSKeyframeRule never happens.

I suppose we could try to make the back-ref strong, but it's simpler to DropReference during unlink.

Olli, any idea how I test this?  I can throw it in a crashtest, but that would assert whenever we happen to cc... can I trigger a cc from a crashtest?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: When unlinking a keyframe rule, make sure to DropReference on its declaration.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 709052 [details] [diff] [review]
When unlinking a keyframe rule, make sure to DropReference on its declaration.

Not sure we need a test for this.

We should have some generic way to call drop/disconnect in unlink. It is rather
common thing.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Actually, maybe even a smart pointer which does disconnect

Comment 6

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a236893f5737

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/a236893f5737