909006 - ASSERTION: event for content that isn't in a document: 'doc', file nsPresShell.cpp, line 6605 when a double click removes its event target from the DOM

Status: NEW

(Core :: Layout, defect)

Description

[Florian Quèze [:florian]]

My debug build prints this in my terminal:

###!!! ASSERTION: event for content that isn't in a document: 'doc', file .../layout/base/nsPresShell.cpp, line 6603
WARNING: NS_ENSURE_TRUE(!aContent || aContent->GetCurrentDoc() == mDocument) failed: file .../layout/base/nsPresShell.cpp, line 6607

since I've replaced:

  box.addEventListener("DOMNodeRemoved", listener);

by:

  MutationObserver(listener).observe(box, {childList: true});

I noticed this on Instantbird (currently using Mozilla 22) on Mac.

This assertion was added in bug 635852. I assume it happens when a mutation event for a removed node is dispatched, but it would be nice if someone who actually knows why this assertion has been added could have a look.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

So what is the testcase?

Comment 2

[Florian Quèze [:florian]]

Attachment: testcase-bug909006.patch

My initial description of the problem was completely wrong: mutation observers aren't involved (I now suspect this was more related to us updating Instantbird to Mozilla 22 a few days ago than to the mutation event changes I was working on today); sorry about that.

This assertion happens when a double click on an element removes it from the DOM.

Steps to reproduce:
1. Apply the attached patch to a current mozilla-central debug build (I tested this only on Mac OS X).
2. Open FirefoxDebug and double click on a tab.

Result:
###!!! ASSERTION: event for content that isn't in a document: 'doc', file /Users/florian/buildhg/mozilla-central/layout/base/nsPresShell.cpp, line 6605
WARNING: NS_ENSURE_TRUE(!aContent || aContent->GetCurrentDoc() == mDocument) failed: file /Users/florian/buildhg/mozilla-central/layout/base/nsPresShell.cpp, line 6609

Comment 3

[Florian Quèze [:florian]]

Attachment: stack-bug909006.txt

Stack of the assertion in comment 2.

Comment 4

[Chris Peterson [:cpeterson]]

I can easily hit this assertion on OS X.

STR:
1. Load http://www.cnn.com/2014/03/05/travel/affordable-caribbean-tripadvisor
2. Advance through the slideshow by clicking the > button.

RESULT:
Usually on slide #4 or #5, I hit the assertion failure:

[53733] ###!!! ASSERTION: event for content that isn't in a document: 'doc', file layout/base/nsPresShell.cpp, line 7009