Bug 573354. Don't assert things that aren't true. r=bernd
authorBoris Zbarsky <bzbarsky@mit.edu>
Fri, 02 Jul 2010 16:56:09 -0400
changeset 47154 3e4c040baff39294c70c2a7d1e3791d96ffd680b
parent 47153 05f5704a084c79c85cac852afe7f4d5072383b2f
child 47155 12b8d2ea6786130b3fb129188b5c7d4ae60bcc82
push idunknown
push userunknown
push dateunknown
reviewersbernd
bugs573354
milestone2.0b2pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 573354. Don't assert things that aren't true. r=bernd
layout/tables/crashtests/573354-1.xhtml
layout/tables/crashtests/crashtests.list
layout/tables/nsTableColGroupFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/573354-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  document.getElementById("c").setAttribute('span', 2);
+  document.getElementById("cg").setAttribute('span', 2);
+}
+</script>
+</head>
+<body onload="boom();">
+<table><colgroup id="cg"><col span="3" id="c" /></colgroup></table>
+</body>
+</html>
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -95,8 +95,9 @@ load 444431-1.html
 load 448988-1.xhtml
 load 450311-1.html
 load 456041.html
 load 457115.html
 load 467141-1.html
 load 488388-1.html
 load 513732-1.html
 load 534716-1.html
+load 573354-1.xhtml
--- a/layout/tables/nsTableColGroupFrame.cpp
+++ b/layout/tables/nsTableColGroupFrame.cpp
@@ -330,19 +330,32 @@ nsTableColGroupFrame::RemoveFrame(nsIAto
   if (nsGkAtoms::tableColFrame == aOldFrame->GetType()) {
     nsTableColFrame* colFrame = (nsTableColFrame*)aOldFrame;
     if (colFrame->GetColType() == eColContent) {
       contentRemoval = PR_TRUE;
       // Remove any anonymous column frames this <col> produced via a colspan
       nsTableColFrame* col = colFrame->GetNextCol();
       nsTableColFrame* nextCol;
       while (col && col->GetColType() == eColAnonymousCol) {
-        NS_ASSERTION(col->GetStyleContext() == colFrame->GetStyleContext() &&
-                     col->GetContent() == colFrame->GetContent(),
-                     "How did that happen??");
+#ifdef DEBUG
+        nsIFrame* providerFrame;
+        PRBool isChild;
+        colFrame->GetParentStyleContextFrame(PresContext(), &providerFrame,
+                                             &isChild);
+        if (colFrame->GetStyleContext()->GetParent() ==
+            providerFrame->GetStyleContext()) {
+          NS_ASSERTION(col->GetStyleContext() == colFrame->GetStyleContext() &&
+                       col->GetContent() == colFrame->GetContent(),
+                       "How did that happen??");
+        }
+        // else colFrame is being removed because of a frame
+        // reconstruct on it, and its style context is still the old
+        // one, so we can't assert anything about how it compares to
+        // col's style context.
+#endif
         nextCol = col->GetNextCol();
         RemoveFrame(nsnull, col);
         col = nextCol;
       }
     }
     
     PRInt32 colIndex = colFrame->GetColIndex();
     // The RemoveChild call handles calling FrameNeedsReflow on us.