368451 - "ASSERTION: Some frame destructors were not called" with :first-letter, :before, counters

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Reloading this testcase triggers:

###!!! ASSERTION: Some frame destructors were not called: 'mFrameCount == 0', file /Users/admin/trunk/mozilla/layout/base/nsPresShell.cpp, line 645

I don't think this instance of the assertion indicates the presence of an exploitable security hole, but I'd like a fix so I can continue testing for the assertion.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Jesse Ruderman]

At one point while the testcase runs, the CSS quotes "<1>" and "</1>" both appear after the quoted text.  Is that behavior correct?

Comment 3

[Boris Zbarsky [:bzbarsky]]

> Is that behavior correct?

No.  And it happens because we end up with a reframe hint for the first-letter (because its "content" property changed), and the node for the first-letter is the (anonymous) text content.  So we try to reframe the anonymous content, and end up putting the frame in a bogus place because we can't compare that sort of thing.

I think the key is really that the content of the first-letter should be the block, not the text.  Compare bug 367650.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Fixed by checkin for bug 367650.