Closed
Bug 381167
Opened 17 years ago
Closed 17 years ago
Crash [@ nsTreeBodyFrame::GetColumns] on closing tab with tree stuff
Categories
(Core :: XUL, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: martijn.martijn, Assigned: smaug)
Details
(4 keywords, Whiteboard: [sg:critical?] deleted tree body)
Crash Data
Attachments
(3 files)
225 bytes,
application/xhtml+xml
|
Details | |
1.32 KB,
patch
|
roc
:
review+
roc
:
superreview+
|
Details | Diff | Splinter Review |
1.26 KB,
patch
|
dveditz
:
approval1.8.1.5+
dveditz
:
approval1.8.0.13+
|
Details | Diff | Splinter Review |
Bug 380217 should be fixed in the nightly 2007-05-18 trunk build, right? I'm still crashing with that build when closing the tab with the attached testcase. Talkback ID: TB32268523G 0x00000000 nsTreeBodyFrame::GetColumns [mozilla/layout/xul/base/src/tree/src/nstreebodyframe.cpp, line 572] nsTreeColFrame::Destroy [mozilla/layout/xul/base/src/tree/src/nstreecolframe.cpp, line 103] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsLineBox::DeleteLineList [mozilla/layout/generic/nslinebox.cpp, line 363] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] CanvasFrame::Destroy [mozilla/layout/generic/nshtmlframe.cpp, line 211] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsFrameManager::Destroy [mozilla/layout/base/nsframemanager.cpp, line 282] DocumentViewerImpl::Hide [mozilla/layout/base/nsdocumentviewer.cpp, line 2041] nsDocShell::SetVisibility [mozilla/docshell/base/nsdocshell.cpp, line 3752] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsFrameList::DestroyFrames [mozilla/layout/generic/nsframelist.cpp, line 60] nsBoxFrame::RemoveFrame [mozilla/layout/xul/base/src/nsboxframe.cpp, line 1008] nsFrameManager::RemoveFrame [mozilla/layout/base/nsframemanager.cpp, line 692] nsCSSFrameConstructor::ContentRemoved [mozilla/layout/base/nscssframeconstructor.cpp, line 9566] PresShell::ContentRemoved [mozilla/layout/base/nspresshell.cpp, line 4474] nsNodeUtils::ContentRemoved [mozilla/content/base/src/nsnodeutils.cpp, line 150] nsGenericElement::doRemoveChildAt [mozilla/content/base/src/nsgenericelement.cpp, line 2450] nsGenericElement::RemoveChildAt [mozilla/content/base/src/nsgenericelement.cpp, line 2399] nsXULElement::RemoveChildAt [mozilla/content/xul/content/src/nsxulelement.cpp, line 907] nsGenericElement::doRemoveChild [mozilla/content/base/src/nsgenericelement.cpp, line 3013] nsGenericElement::RemoveChild [mozilla/content/base/src/nsgenericelement.cpp, line 2583] XPCWrappedNative::CallMethod [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2245] It also crashes in branch builds, so I'm marking it security sensitve for now.
Assignee | ||
Comment 1•17 years ago
|
||
This is something else than Bug 380217. Taking
Assignee: Jan.Varga → Olli.Pettay
Assignee | ||
Comment 2•17 years ago
|
||
Attachment #265304 -
Flags: superreview?(roc)
Attachment #265304 -
Flags: review?(roc)
Attachment #265304 -
Flags: superreview?(roc)
Attachment #265304 -
Flags: superreview+
Attachment #265304 -
Flags: review?(roc)
Attachment #265304 -
Flags: review+
Assignee | ||
Updated•17 years ago
|
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Assignee | ||
Comment 3•17 years ago
|
||
Or should it be approval1.8.1.4?
Attachment #265491 -
Flags: approval1.8.1.5?
Attachment #265491 -
Flags: approval1.8.0.13?
Updated•17 years ago
|
Flags: wanted1.8.1.x+
Flags: wanted1.8.0.x+
Flags: blocking1.8.1.5?
Flags: blocking1.8.0.13?
Whiteboard: [sg:critical?] deleted tree body
Reporter | ||
Comment 4•17 years ago
|
||
Verified fixed, using: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070524 Minefield/3.0a5pre
Status: RESOLVED → VERIFIED
Updated•17 years ago
|
Flags: blocking1.8.1.5?
Flags: blocking1.8.1.5+
Flags: blocking1.8.0.13?
Flags: blocking1.8.0.13+
Comment 5•17 years ago
|
||
Comment on attachment 265491 [details] [diff] [review] for branch approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers
Attachment #265491 -
Flags: approval1.8.1.5?
Attachment #265491 -
Flags: approval1.8.1.5+
Attachment #265491 -
Flags: approval1.8.0.13?
Attachment #265491 -
Flags: approval1.8.0.13+
Assignee | ||
Updated•17 years ago
|
Keywords: fixed1.8.0.13,
fixed1.8.1.5
Comment 6•17 years ago
|
||
verified fixed 1.8.1.5 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.5pre) Gecko/20070704 BonEcho/2.0.0.5pre ID:2007070403 and tested with the testcase in this bug. No crash on Testcase during testings - adding verified keyword
Keywords: fixed1.8.1.5 → verified1.8.1.5
Comment 7•17 years ago
|
||
verified 1.8.0.13 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.13pre) Gecko/20070822 Firefox/1.5.0.13pre - no crash on testcase - adding verified keyword
Keywords: fixed1.8.0.13 → verified1.8.0.13
Updated•17 years ago
|
Group: security
Flags: in-testsuite?
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: xptoolkit.trees → xptoolkit.widgets
Comment 8•15 years ago
|
||
mochitest landed http://hg.mozilla.org/mozilla-central/rev/7f42099b2402
Flags: in-testsuite? → in-testsuite+
Updated•13 years ago
|
Crash Signature: [@ nsTreeBodyFrame::GetColumns]
You need to log in
before you can comment on or make changes to this bug.
Description
•