Closed Bug 114547 Opened 24 years ago Closed 23 years ago

nsXULTreeGroupFrame::OnContentRemoved releases frame after destruction

Categories

(Core :: Layout, defect, P2)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Milestone:
Future

People

(Reporter: dbaron, Assigned: dbaron)

References

Details

nsXULTreeGroupFrame::OnContentRemoved accesses a frame after it is destroyed with the nsCOMPtr nsIXULTreeSlice. It probably just shouldn't be an nsCOMPtr since it's never going to be refcounted, although it could also be fixed by scoping the nsCOMPtr in a block.
Blocks: 114219
Status: NEW → ASSIGNED
Priority: -- → P2
Target Milestone: --- → mozilla0.9.8
Target Milestone: mozilla0.9.8 → mozilla0.9.9
Target Milestone: mozilla0.9.9 → Future
This code doesn't exist anymore.
Status: ASSIGNED → RESOLVED
Closed: 23 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.