Bug 19527 - ASSERTION FAILED: containerA && containerB
Summary: ASSERTION FAILED: containerA && containerB
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Alexey Proskuryakov
Depends on:
Reported: 2008-06-12 16:50 PDT by danceoffwithyourpantsoff
Modified: 2009-02-26 10:18 PST (History)
1 user (show)

See Also:

test case (will assert) (110 bytes, text/html)
2008-06-12 21:52 PDT, Alexey Proskuryakov
no flags Details
proposed fix (7.33 KB, patch)
2009-02-16 10:58 PST, Alexey Proskuryakov
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description danceoffwithyourpantsoff 2008-06-12 16:50:54 PDT
ASSERTION FAILED: containerA && containerB

It looks like comparePoint specifically deals with the possibility that a range is detached and it's m_start.container is null.  However, compareBoundaryPoints asserts that both are non-null, but returns different (-1 vs 1) if one of them is NULL.  Maybe the ASSERT is just invalid?

var ra = document.createRange();
Comment 1 Alexey Proskuryakov 2008-06-12 21:52:10 PDT
Created attachment 21671 [details]
test case (will assert)
Comment 2 Alexey Proskuryakov 2008-06-12 21:53:11 PDT
Confirmed with r34513.
Comment 3 Alexey Proskuryakov 2009-02-16 10:58:22 PST
Created attachment 27700 [details]
proposed fix

I think that the ASSERT is correct - it's the release-only code below it that's probably unneeded, but was added for extra safety.
Comment 4 Darin Adler 2009-02-26 09:46:04 PST
Comment on attachment 27700 [details]
proposed fix

Does this behavior match something in some specification, or is this a gray area?

Comment 5 Alexey Proskuryakov 2009-02-26 10:02:00 PST
These methods are Firefox extensions, without much documentation.
Comment 6 Alexey Proskuryakov 2009-02-26 10:18:04 PST
Committed revision 41253.