Crash adding <treechildren> in an RDF template in a tree

VERIFIED FIXED in M10

Status

()

Core
XUL
P2
critical
VERIFIED FIXED
19 years ago
a year ago

People

(Reporter: Alec Flett, Assigned: David Hyatt)

Tracking

Trunk
x86
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

19 years ago
I'm trying to set up a tree so that every item in the tree has a few special
hard-coded children, for example:

- Account1
   Server Settings
   Identity
- Account2
   Server Settings
   Identity

Where "Account1" and "Account2" are names of accounts that come from an RDF
datasource.

so I define an RDF template as follows:
<tree rdf:datasources="rdf:msgaccountmanager"
      onclick="showPage(event)" id="accounttree"
      style="height: 100%"
      ref="msgaccounts:/">

  <template>
  	<rule>
           <treechildren>
		<treeitem uri="...">
	  		<treerow >
                  <treecell treeallowevents="true">
                    <titledbutton class="twisty"/>
                  </treecell>
                  <treecell>
                    <treeindentation/>
		    <titledbutton value="rdf:http://home.netscape.com/NC-rdf#Name"
align="right" />
                  </treecell>
  		</treerow>
                <treechildren>
                  <treeitem>
                    <treerow>
                      <treecell/>
                      <treecell>
                        <treeindentation/>
                         Server Settings
                      </treecell>
                    </treerow>
                   </treeitem>
                  <treeitem>
                    <treerow>
                      <treecell/>
                      <treecell>
                        <treeindentation/>
                         Identity
                      </treecell>
                    </treerow>
                   </treeitem>
                 </treechildren>
	    </treeitem>
          </treechildren>
	</rule>
  </template>
</tree>


But it always crashes in libraptorhtml.so of all places... the stack trace is
enormous (77 frames) so I won't post it here, but it seems to be in reflowing
the table. Here's the top frame:

(gdb) frame 0
#0  0x40ca2631 in nsTextTransformer::GetNextWord (this=0xbfff8d0c, aInWord=0,
    aWordLenResult=@0xbfff8d00, aContentLenResult=@0xbfff8d04,
    aIsWhitespaceResult=@0xbfff8d08, aForLineBreak=1)
    at nsTextTransformer.cpp:187
(gdb) list
182
183	  // Set the isWhitespace flag by examining the next character in the
184	  // text fragment.
185	  PRInt32 offset = mCurrentFragOffset;
186	  PRUnichar firstChar;
187 =>	  if (frag->Is2b()) {
188	    const PRUnichar* up = frag->Get2b();
189	    firstChar = up[offset];
190	  }
191	  else {
(gdb) print frag
$1 = (nsTextFragment *) 0x1

Comment 1

19 years ago
Alec, shouldn't this be critical severity, or blocker if it is blocking you?
(Reporter)

Updated

19 years ago
Severity: normal → critical
(Reporter)

Comment 2

19 years ago
yes, you're right. Thanks.
Making it critical because I have a really really bad non-localizable
workaround.

Comment 3

19 years ago
Thanks, but since you do have a workaround, we'll have to also take that into
consideration in setting the priority...
(Reporter)

Comment 4

19 years ago
it's a non-localizable workaround though. we can't ship the final product with
it.

Comment 5

19 years ago
But we can sure ship M9 with it...

Updated

19 years ago
Priority: P3 → P2
Target Milestone: M10

Comment 6

19 years ago
targetting as p2 for M10
(Assignee)

Updated

19 years ago
Status: NEW → ASSIGNED
(Assignee)

Comment 7

19 years ago
Robert, does this template look good to you?

Comment 8

19 years ago
I think the template looks OK.

Here's a question: does it work if, instead of having a text node created "Server
Settings" and "Identity", you create a titledbutton instead whose value is the
text? I'm guessing there is a bug in layout with regards to text nodes and its
choking on those strings.
(Reporter)

Comment 9

19 years ago
actually, I tried that and it still crashed
Bummer.
(Assignee)

Comment 11

19 years ago
This does seem to be more of a layout bug.  It must be having a problem with a
particular string.
(Reporter)

Comment 12

19 years ago
Interesting. I just tried to create a tab widget with the following template:
        <tabcontrol align="vertical">
          <tabbox rdf:datasources="rdf:msgaccountmanager"
                  rdf:containment="http://home.netscape.com/NC-rdf#Settings"
                  ref="msgaccounts:/">
            <template>
              <rule>
                <tab uri="...">a settings page?</tab>
              </rule>
            </template>
          </tabbox>

          <tabpanel>
          </tabpanel>
        </tabcontrol>

and it crashed here:
#0  0x40cb7898 in nsTextTransformer::GetNextWord (this=0xbfffc188, aInWord=0,
    aWordLenResult=@0xbfffc17c, aContentLenResult=@0xbfffc180,
    aIsWhitespaceResult=@0xbfffc184, aForLineBreak=1)
    at nsTextTransformer.cpp:195
#1  0x40cb5de2 in nsTextFrame::Reflow (this=0x87d8628,
    aPresContext=@0x8590768, aMetrics=@0xbfffc384, aReflowState=@0xbfffc3b4,
    aStatus=@0xbfffc498) at nsTextFrame.cpp:2421
#2  0x40ca2445 in nsLineLayout::ReflowFrame (this=0xbfffc834,
    aFrame=0x87d8628, aNextRCFrame=0xbfffc658, aReflowStatus=@0xbfffc498)
    at nsLineLayout.cpp:840
#3  0x40c8476f in nsBlockFrame::ReflowInlineFrame (this=0x87ba6b0,
    aState=@0xbfffc5e0, aLine=0x87d8678, aFrame=0x87d8628,
    aLineReflowStatus=0xbfffc4e7 "") at nsBlockFrame.cpp:3087
#4  0x40c844d4 in nsBlockFrame::ReflowInlineFrames (this=0x87ba6b0,
    aState=@0xbfffc5e0, aLine=0x87d8678, aKeepReflowGoing=0xbfffc578)
    at nsBlockFrame.cpp:2966
#5  0x40c83162 in nsBlockFrame::ReflowLine (this=0x87ba6b0,
    aState=@0xbfffc5e0, aLine=0x87d8678, aKeepReflowGoing=0xbfffc578,
    aDamageDirtyArea=0) at nsBlockFrame.cpp:2181
#6  0x40c82b62 in nsBlockFrame::ReflowDirtyLines (this=0x87ba6b0,
    aState=@0xbfffc5e0) at nsBlockFrame.cpp:1928
#7  0x40c82049 in nsBlockFrame::Reflow (this=0x87ba6b0,
    aPresContext=@0x8590768, aMetrics=@0xbfffe97c, aReflowState=@0xbfffe718,
---Type <return> to continue, or q <return> to quit---
    aStatus=@0xbfffe950) at nsBlockFrame.cpp:1238
#8  0x40c7fd35 in nsAreaFrame::Reflow (this=0x87ba6b0,
    aPresContext=@0x8590768, aDesiredSize=@0xbfffe97c,
    aReflowState=@0xbfffe718, aStatus=@0xbfffe950) at nsAreaFrame.cpp:344
#9  0x40c8b322 in nsContainerFrame::ReflowChild (this=0x87b9ff0,
    aKidFrame=0x87ba6b0, aPresContext=@0x8590768, aDesiredSize=@0xbfffe97c,
    aReflowState=@0xbfffe718, aStatus=@0xbfffe950) at nsContainerFrame.cpp:439
(More stack frames follow...)


190	    const PRUnichar* up = frag->Get2b();
191	    firstChar = up[offset];
192	  }
193	  else {
194	    const unsigned char* cp = (const unsigned char*) frag->Get1b();
195 =>	    firstChar = PRUnichar(cp[offset]);
196	  }
197	  PRBool isWhitespace = XP_IS_SPACE(firstChar);
198	  offset++;
199	  if (isWhitespace) {

I can't seem to read the value of "cp" but "offset" is huge (1076548124)

It seems like the content model is not being built correctly for anything other
than menus and trees with very simple structures.
(Reporter)

Comment 13

19 years ago
oh! I changed that template to use a titledbutton and all of a sudden it works
fine...
[Not that is really matters, but since your "rule" tag is "empty" (it doesn't
have any attributes on it to match against anything), you can remove the
"<rule>" and "</rule>" tags.]
(Reporter)

Comment 15

19 years ago
in a discussion on mozilla-xpfe, hyatt described a similar template as
"malformed" and I'm wondering if it has to do with the fact that the "pivitol"
node has siblings in this example.
(see how the "<treeitem>" with the uri="..." tag has a sibling called
"<treechildren>"?

I would argue that the template should "pivot" all siblings in addition to the
pivitol node, creating a copy of each sibling before/after each dynamically
created node.

Comment 16

19 years ago
Hmm. If _that's what you really want, maybe the right thing to do is to
introduce a <pivot> element around which this happens; e.g., instead of

<treechildren>
  <treeitem uri="...">
    ...
  </treeitem>
</treechildren>

you'd have:

<treechildren>
  <pivot> <!-- or whatever, think of a better name -->
    <treeitem>
    </treeitem>
  </pivot>
</treechildren>

The only problem is, if <pivot> has >1 kid, to whom do you assign the URI from
RDF? :-(
(Reporter)

Comment 17

19 years ago
right. but even so, what I really want is:
<treechildren>
  <treeitem uri="..."> ... </treeitem>
  <treechildren> ...</treechildren>
</treechildren>

So I could do this:
<treechildren>
  <pivot uri="...">
  <treeitem uri="...">...</treeitem>
  <treechildren> ... </treechildren>
  </pivot>
<treechildren>

But wouldn't the tree get confused because the child of the <treechildren> is a
<pivot> or whatever?
Also, will the second uri="..." get filled in without actually making that node
a pivot?

I think this <pivot> concept could be really cool though, if it were treated
specially by the template so that it inserted the pivot's children where the
pivot would have gone.
(Assignee)

Comment 18

19 years ago
The tree example is malformed.  I'm not sure what you're trying to do here.  A
treechildren tag can only contain treeitem tags as children.  It cannot contain
anything else.  If it happens to work, then you're getting lucky.

Comment 19

19 years ago
Yeah, hyatt's right. You don't want a <treechildren> DIRECTLY enclosing another
<treechildren>, do you???
(Reporter)

Comment 20

19 years ago
oh whoops.
you're right.

I wonder if that's part of my problem.
(Assignee)

Updated

19 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 19 years ago
Resolution: --- → FIXED
(Assignee)

Comment 21

19 years ago
Marking fixed.

Updated

19 years ago
QA Contact: ckritzer → alecf

Comment 22

19 years ago
Assigning to originator per new organizational structure.

Updated

18 years ago
QA Contact: alecf → ckritzer

Comment 23

18 years ago
Changing QA Contact back to ckritzer@netscpe.com.

Updated

18 years ago
Status: RESOLVED → VERIFIED

Comment 24

18 years ago
marking verified, alec is happy now

Comment 25

18 years ago
BULK MOVE: Changing component from XUL to XP Toolkit/Widgets: XUL.  XUL 
component will be deleted.
Component: XUL → XP Toolkit/Widgets: XUL

Updated

10 years ago
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: ckritzer → xptoolkit.widgets
You need to log in before you can comment on or make changes to this bug.