274808 - Crash when dragging onto a tree [@ nsXULTreeBuilder::GetTemplateActionCellFor ]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Neil Deakin]

When there is a tree that does not have a primary column, there is a crash when
dragging onto it. The crash occurs trying to paint the drop marker line.

0x416775a0 in nsXULTreeBuilder::GetTemplateActionCellFor(int, nsITreeColumn*,
nsIContent**) (this=0x43201a68, aRow=2, aCol=0x0, aResult=0xbfffea30)
    at nsXULTreeBuilder.cpp:1478
0x41674a2a in nsXULTreeBuilder::GetImageSrc(int, nsITreeColumn*, nsAString&)
(this=0x43201a68, aRow=2, aCol=0x0, aResult=@0xbfffea30)
    at nsXULTreeBuilder.cpp:690
0x41634482 in nsTreeBodyFrame::GetImage(int, nsTreeColumn*, int,
nsStyleContext*, int&, imgIContainer**) (this=0x4327e1f0, aRowIndex=2, aCol=0x0,
    aUseContext=1, aStyleContext=0x4333a7a0, aAllowImageRegions=@0xbfffeb3c,
    aResult=0xbfffeb50) at nsTreeBodyFrame.cpp:1629
0x41634d41 in nsTreeBodyFrame::GetImageSize(int, nsTreeColumn*, int,
nsStyleContext*) (this=0x4327e1f0, aRowIndex=2, aCol=0x0, aUseContext=1,
    aStyleContext=0x4333a7a0) at nsTreeBodyFrame.cpp:1755
0x4163817a in nsTreeBodyFrame::PaintDropFeedback(nsRect const&, nsPresContext*,
nsIRenderingContext&, nsRect const&) (this=0x4327e1f0,
    aDropFeedbackRect=@0xbfffec90, aPresContext=0x431ddac0,
    aRenderingContext=@0x43188b30, aDirtyRect=@0xbfffedd0)
    at nsTreeBodyFrame.cpp:3105

Comment 1

[Neil Deakin]

Attachment: Check if column is null

The nsXULTreeBuilder change is where the crash was. Fixing that will properly
throw an exception when other calls are made to it with a null column. See bug
245459 for instance.

Comment 2

[timeless]

*** Bug 245459 has been marked as a duplicate of this bug. ***

Comment 3

[Brian Ryner (not reading)]

Comment on attachment 168801 [details] [diff] [review]
Check if column is null

Looks good, though I do see that no one actually cares about the result code
from GetTemplateActionCellFor... good future deCOMtamination site.

Comment 4

[Jan Varga [:janv]]

checked in