Closed Bug 866659 Opened 8 years ago Closed 8 years ago

"Assertion failure: rangeFrame->GetType() == nsGkAtoms::rangeFrame" with <input type=range> root

Categories

(Core :: Widget: Cocoa, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla28

People

(Reporter: jruderman, Assigned: jwatt)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Assertion failure: rangeFrame->GetType() == nsGkAtoms::rangeFrame, at /Users/jruderman/trees/mozilla-central/widget/xpwidgets/nsNativeTheme.cpp:676

This code was added in bug 846883 and bug 855301.
Attached file stack (gdb)
jwatt, could you have a look into this?
Assignee: nobody → jwatt
The reason that this happens is because for the root element we call nsCSSFrameConstructor::ConstructDocElementFrame. That method doesn't bother to look at the HTML element type; for non-table HTML frames it just creates the frame using NS_NewBlockFrame:

http://mxr.mozilla.org/mozilla-central/source/layout/base/nsCSSFrameConstructor.cpp?rev=aad5b909924d#2451

That's how we unfortunately end up with a non-nsRangeFrame with |StyleDisplay()->mAppearance == NS_THEME_RANGE|, which is why we hit the assertion before the cast:

https://mxr.mozilla.org/mozilla-central/source/widget/xpwidgets/nsNativeTheme.cpp?rev=aad5b909924d#669
Attached patch patchSplinter Review
Attachment #826781 - Flags: review?(bzbarsky)
Note that we'll also hit this assertion for any non-<input type=range> that has |-moz-appearance:range|.
Comment on attachment 826781 [details] [diff] [review]
patch

r=me
Attachment #826781 - Flags: review?(bzbarsky) → review+
https://hg.mozilla.org/mozilla-central/rev/c8f394c6c27e
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Reproduced in 2013-06-19-mozilla-central-debug.
Verified fixed 2013-11-27-mozilla-central-debug Win 7 x64.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.