Bug 573354. Don't assert things that aren't true. r=bernd
authorBoris Zbarsky <bzbarsky@mit.edu>
Fri, 02 Jul 2010 16:56:09 -0400
changeset 47154 3e4c040baff39294c70c2a7d1e3791d96ffd680b
parent 47153 05f5704a084c79c85cac852afe7f4d5072383b2f
child 47155 12b8d2ea6786130b3fb129188b5c7d4ae60bcc82
push idunknown
push userunknown
push dateunknown
reviewersbernd
bugs573354
milestone2.0b2pre
Bug 573354. Don't assert things that aren't true. r=bernd
layout/tables/crashtests/573354-1.xhtml
layout/tables/crashtests/crashtests.list
layout/tables/nsTableColGroupFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/573354-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  document.getElementById("c").setAttribute('span', 2);
+  document.getElementById("cg").setAttribute('span', 2);
+}
+</script>
+</head>
+<body onload="boom();">
+<table><colgroup id="cg"><col span="3" id="c" /></colgroup></table>
+</body>
+</html>
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -95,8 +95,9 @@ load 444431-1.html
 load 448988-1.xhtml
 load 450311-1.html
 load 456041.html
 load 457115.html
 load 467141-1.html
 load 488388-1.html
 load 513732-1.html
 load 534716-1.html
+load 573354-1.xhtml
--- a/layout/tables/nsTableColGroupFrame.cpp
+++ b/layout/tables/nsTableColGroupFrame.cpp
@@ -330,19 +330,32 @@ nsTableColGroupFrame::RemoveFrame(nsIAto
   if (nsGkAtoms::tableColFrame == aOldFrame->GetType()) {
     nsTableColFrame* colFrame = (nsTableColFrame*)aOldFrame;
     if (colFrame->GetColType() == eColContent) {
       contentRemoval = PR_TRUE;
       // Remove any anonymous column frames this <col> produced via a colspan
       nsTableColFrame* col = colFrame->GetNextCol();
       nsTableColFrame* nextCol;
       while (col && col->GetColType() == eColAnonymousCol) {
-        NS_ASSERTION(col->GetStyleContext() == colFrame->GetStyleContext() &&
-                     col->GetContent() == colFrame->GetContent(),
-                     "How did that happen??");
+#ifdef DEBUG
+        nsIFrame* providerFrame;
+        PRBool isChild;
+        colFrame->GetParentStyleContextFrame(PresContext(), &providerFrame,
+                                             &isChild);
+        if (colFrame->GetStyleContext()->GetParent() ==
+            providerFrame->GetStyleContext()) {
+          NS_ASSERTION(col->GetStyleContext() == colFrame->GetStyleContext() &&
+                       col->GetContent() == colFrame->GetContent(),
+                       "How did that happen??");
+        }
+        // else colFrame is being removed because of a frame
+        // reconstruct on it, and its style context is still the old
+        // one, so we can't assert anything about how it compares to
+        // col's style context.
+#endif
         nextCol = col->GetNextCol();
         RemoveFrame(nsnull, col);
         col = nextCol;
       }
     }
     
     PRInt32 colIndex = colFrame->GetColIndex();
     // The RemoveChild call handles calling FrameNeedsReflow on us.