9119 - Crash when doing multiple selection

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[scottputterman]

If I select an message in the Messenger thread pane and then scroll down and
select another item with shift-click, I get the following crash:

nsTreeCellFrame::Select(nsIPresContext & {...}, int 1, int 1) line 281 + 27
bytes
nsTreeFrame::RangedSelection(nsIPresContext & {...}, nsTreeCellFrame *
0x05a7f680) line 152
nsTreeCellFrame::HandleMouseDownEvent(nsIPresContext & {...}, nsGUIEvent *
0x0012fbb0, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 193
nsTreeCellFrame::HandleEvent(nsTreeCellFrame * const 0x05a7f680, nsIPresContext
& {...}, nsGUIEvent * 0x0012fbb0, nsEventStatus &
nsEventStatus_eConsumeDoDefault) line 168
PresShell::HandleEvent(PresShell * const 0x04dfb284, nsIView * 0x04dfb670,
nsGUIEvent * 0x0012fbb0, nsEventStatus & nsEventStatus_eConsumeDoDefault) line
2066 + 38 bytes
nsView::HandleEvent(nsView * const 0x04dfb670, nsGUIEvent * 0x0012fbb0, unsigned
int 28, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 833
nsViewManager::DispatchEvent(nsViewManager * const 0x04dfb890, nsGUIEvent *
0x0012fbb0, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 1735
HandleEvent(nsGUIEvent * 0x0012fbb0) line 67
nsWindow::DispatchEvent(nsWindow * const 0x04dfb544, nsGUIEvent * 0x0012fbb0,
nsEventStatus & nsEventStatus_eIgnore) line 434 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbb0) line 455
nsWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000 {x=???
y=???}) line 3116 + 15 bytes
ChildWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000 {x=???
y=???}) line 3265
nsWindow::ProcessMessage(unsigned int 513, unsigned int 5, long 13303882, long *
0x0012fdc0) line 2390 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x00110e08, unsigned int 513, unsigned int 5, long
13303882) line 497 + 27 bytes
USER32! 77e71250()

Comment 1

[David Hyatt]

This does not surprise me.  As putterman and I discussed, selection will get
horked now, since I'm destroying the original selected frames as they scroll
offscreen (and then I try to reference them later).

Comment 2

[lchiang]

Would this be for all platforms?

Comment 3

[scottputterman]

Probably.  But I haven't tried it on other platforms.  I'll change it anyway.

Comment 4

[David Hyatt]

Note to self. Move selection array into the tree content node and don't make it
dependent on frames.

Comment 5

[lchiang]

<updated release note tracking bug for M8>

Comment 6

[David Hyatt]

Fixed with the selection rewrite.  See the XPFE newsgroup for details regarding
the new tree widget selection API.

Comment 7

[phillip]

marking verified due to discussion with scott.