Text control frames get readded to the primary frame map during their destruction in some cases, after they've been removed. This can lead to stale frames (the text control frame, and up its ancestor chain) being in the map. See attachment 59623 [details] on bug 105619 for a testcase and bug 105619 comment 57 for a stack. I'll attach a patch that prevents this from happening by passing the frame from frame to content in some cases, as jst suggested.

The change in nsFrameManager.cpp needs to check for non-null ops, i.e.: #ifdef DEBUG if (mPrimaryFrameMap.ops) { nsCOMPtr<nsIContent> content; aFrame->GetContent(getter_AddRefs(content)); PrimaryFrameMapEntry *entry = NS_STATIC_CAST(PrimaryFrameMapEntry*, PL_DHashTableOperate(&mPrimaryFrameMap, content, PL_DHASH_LOOKUP)); NS_ASSERTION(!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame, "frame was not removed from primary frame map before" "destruction or was readded to map after being removed"); } #endif

Comment on attachment 60945 [details] [diff] [review] patch sr=jst, but please also make nsIGfxTextControlFrame use NS_DEFINE_STATIC_IID_ACCESSOR() for defining the IID accessor.

Comment on attachment 60945 [details] [diff] [review] patch r=jkeiser

dbaron landed the fix on 12/10/2001 21:39

This may have also fixed bug 108704.

Oh, and the fact that I forgot to check in my comment #2 caused bug 114675, but was easily fixed.

*** Bug 108704 has been marked as a duplicate of this bug. ***