If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

"ASSERTION: DropReference not called" after accessing child cssRule

RESOLVED FIXED in mozilla21

Status

()

Core
DOM: CSS Object Model
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: bz)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla21
x86_64
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

5 years ago
Created attachment 708926 [details]
testcase

1. Load the testcase
2. Close the testcase, then force a cycle collection.  (Or just quit the browser.)

###!!! ASSERTION: DropReference not called.: '!mRule', file layout/style/nsCSSRules.cpp, line 1930
(Reporter)

Comment 1

5 years ago
Created attachment 708927 [details]
stack (with CC triggered from about:memory)
This is a regression from bug 774980.  The problem is that we unlink the objects now, so the DropReference call in ~nsCSSKeyframeRule never happens.

I suppose we could try to make the back-ref strong, but it's simpler to DropReference during unlink.

Olli, any idea how I test this?  I can throw it in a crashtest, but that would assert whenever we happen to cc... can I trigger a cc from a crashtest?
Assignee: nobody → bzbarsky
Blocks: 774980
Created attachment 709052 [details] [diff] [review]
When unlinking a keyframe rule, make sure to DropReference on its declaration.
Attachment #709052 - Flags: review?(bugs)
Whiteboard: [need review]

Comment 4

5 years ago
Comment on attachment 709052 [details] [diff] [review]
When unlinking a keyframe rule, make sure to DropReference on its declaration.

Not sure we need a test for this.

We should have some generic way to call drop/disconnect in unlink. It is rather
common thing.
Attachment #709052 - Flags: review?(bugs) → review+

Comment 5

5 years ago
Actually, maybe even a smart pointer which does disconnect
https://hg.mozilla.org/integration/mozilla-inbound/rev/a236893f5737
Flags: in-testsuite-
Whiteboard: [need review]
Target Milestone: --- → mozilla21
https://hg.mozilla.org/mozilla-central/rev/a236893f5737
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.