866659 - "Assertion failure: rangeFrame->GetType() == nsGkAtoms::rangeFrame" with <input type=range> root

Status: VERIFIED FIXED

(Core :: Widget: Cocoa, defect)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

Assertion failure: rangeFrame->GetType() == nsGkAtoms::rangeFrame, at /Users/jruderman/trees/mozilla-central/widget/xpwidgets/nsNativeTheme.cpp:676

This code was added in bug 846883 and bug 855301.

Comment 1

[Jesse Ruderman]

Attachment: stack (gdb)

Comment 2

[Mounir Lamouri (:mounir)]

jwatt, could you have a look into this?

Comment 3

[Jonathan Watt [:jwatt]]

The reason that this happens is because for the root element we call nsCSSFrameConstructor::ConstructDocElementFrame. That method doesn't bother to look at the HTML element type; for non-table HTML frames it just creates the frame using NS_NewBlockFrame:

http://mxr.mozilla.org/mozilla-central/source/layout/base/nsCSSFrameConstructor.cpp?rev=aad5b909924d#2451

That's how we unfortunately end up with a non-nsRangeFrame with |StyleDisplay()->mAppearance == NS_THEME_RANGE|, which is why we hit the assertion before the cast:

https://mxr.mozilla.org/mozilla-central/source/widget/xpwidgets/nsNativeTheme.cpp?rev=aad5b909924d#669

Comment 4

[Jonathan Watt [:jwatt]]

Attachment: patch

Comment 5

[Jonathan Watt [:jwatt]]

Note that we'll also hit this assertion for any non-<input type=range> that has |-moz-appearance:range|.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 826781 [details] [diff] [review]
patch

r=me

Comment 7

[Jonathan Watt [:jwatt]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c8f394c6c27e

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c8f394c6c27e

Comment 9

[Paul Silaghi, QA [:pauly]]

Reproduced in 2013-06-19-mozilla-central-debug.
Verified fixed 2013-11-27-mozilla-central-debug Win 7 x64.