cvs build from sunday w/ various patches to lots of places except docshell. I think this is happening when i load my broken composer window ###!!! ASSERTION: subshell not in the map: 'shellContent', file i:/build/mozilla/docshell/base/nsDocShell.cpp, line 3245 Break: at file i:/build/mozilla/docshell/base/nsDocShell.cpp, line 3245 nsDebug::Assertion(const char * 0x07da687c, const char * 0x07da686c, const char * 0x07da683c, int 3245) line 280 + 13 bytes nsDocShell::GetVisibility(nsDocShell * const 0x11290554, int * 0x0012e714) line 3245 + 38 bytes nsEventStateManager::IsShellVisible(nsIDocShell * 0x11290540) line 5053 nsEventStateManager::HandleAccessKey(nsIPresContext * 0x10c47150, nsKeyEvent * 0x0012f110, nsEventStatus * 0x0012ef48, int -1, nsEventStateManager::ProcessingAccessKeyState eAccessKeyProcessingNormal) line 989 + 42 bytes nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x10ffa9d0, nsIPresContext * 0x10c47150, nsEvent * 0x0012f110, nsIFrame * 0x110196c4, nsEventStatus * 0x0012ef48, nsIView * 0x109f1db0) line 806 PresShell::HandleEventInternal(nsEvent * 0x0012f110, nsIView * 0x109f1db0, unsigned int 1, nsEventStatus * 0x0012ef48) line 6147 + 43 bytes PresShell::HandleEvent(PresShell * const 0x10e0c014, nsIView * 0x109f1db0, nsGUIEvent * 0x0012f110, nsEventStatus * 0x0012ef48, int 1, int & 1) line 6076 + 25 bytes nsViewManager::HandleEvent(nsView * 0x109f1db0, nsGUIEvent * 0x0012f110, int 0) line 2165 nsView::HandleEvent(nsViewManager * 0x108011a0, nsGUIEvent * 0x0012f110, int 0) line 304 nsViewManager::DispatchEvent(nsViewManager * const 0x108011a0, nsGUIEvent * 0x0012f110, nsEventStatus * 0x0012f080) line 1945 + 23 bytes HandleEvent(nsGUIEvent * 0x0012f110) line 83 nsWindow::DispatchEvent(nsWindow * const 0x109e2964, nsGUIEvent * 0x0012f110, nsEventStatus & nsEventStatus_eIgnore) line 1113 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f110) line 1134 nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 192, long 0) line 3009 + 15 bytes nsWindow::OnIMENotify(unsigned int 1, long 0, long * 0x0012f57c) line 6522 nsWindow::ProcessMessage(unsigned int 642, unsigned int 1, long 0, long * 0x0012f57c) line 4445 + 23 bytes nsWindow::WindowProc(HWND__ * 0x00c10760, unsigned int 642, unsigned int 1, long 0) line 1400 + 27 bytes shellContent is null (this appears to be a valid return and is paired with NS_IFADDREF and NS_OK) FindContentEnumerator(PLDHashTable * 0x112743e0, PLDHashEntryHdr * 0x110249f4, unsigned int 0, void * 0x0012e5bc) line 1188 PL_DHashTableEnumerate(PLDHashTable * 0x112743e0, int (PLDHashTable *, PLDHashEntryHdr *, unsigned int, void *)* 0x040fc270 FindContentEnumerator(PLDHashTable *, PLDHashEntryHdr *, unsigned int, void *), void * 0x0012e5bc) line 603 + 34 bytes nsXULDocument::FindContentForSubDocument(nsXULDocument * const 0x105d4850, nsIDocument * 0x1126eda8, nsIContent * * 0x0012e6b4) line 1210 + 24 bytes is only called once - data->mSubDocument 0x1126eda8 \+ __vfptr 0x0433a438 const nsHTMLDocument::`vftable'{for `nsIDocument'} - entry->mSubDocument 0x11024ac0 |+ [nsHTMLDocument] {...} \+ nsISupports {...}

still recurs w/ cvs from today. i'm triggering it by pressing alt-w (I expected this to trigger the window menu). i have: 1 navigator w/ 2 tabs the first tab has a bug (186675) the second tab has cvs blame (....) pressing alt-w in the first tab activates status whiteboard pressing alt-w in the second tab asserts

Bernd's testcase WFM, Mac trunk.

On load I get: ###!!! ASSERTION: subshell not in the map: 'shellContent', file nsDocShell.cpp, line 3721 WARNING: NS_ENSURE_TRUE(aContent) failed: file nsFrameManager.cpp, line 324 On Reload also gives: ###!!! ASSERTION: Adding child where we already have a child? This will likely misbehave: 'Error', file nsSHEntry.cpp, line 536

Mats' testcase WFM too (Mac trunk). I get the "Adding child where we already have a child?" assertion but not the "subshell not in the map" assertion.

When clicking in the iframe and then reloading, I get the "subshell not in the map" assertion.

I tried that (Cmd+R, Cmd+Shift+R, and clicking the reload button) and I still don't see the "subshell not in the map" assertion with testcase 2.

The "subshell not in the map" assertion was removed in Bug 854421 Part 12: https://hg.mozilla.org/mozilla-central/rev/dc1eb7543012 ... so I'm resolving this bug as WFM based on that, but please feel free to re-open if the "Adding child where we already have a child?" assertion is still relevant.

I still see the "Adding child where we already have a child?" assertion when reloading the first testcase. We don't seem to have a bug open on that so reopening to track that.

That assertion might be covered by bug 645229.

Related bugs #645229, #751208, #958976 , #986122 ?