Editable menulist in arrowscrollbox results in an nsScrollPortView with no parent view

RESOLVED DUPLICATE of bug 209365

Status

()

RESOLVED DUPLICATE of bug 209365
15 years ago
15 years ago

People

(Reporter: timwatt, Unassigned)

Tracking

Trunk
x86
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

367 bytes, application/vnd.mozilla.xul+xml
Details
11.85 KB, text/plain
Details
(Reporter)

Description

15 years ago
http://lxr.mozilla.org/seamonkey/source/view/src/nsViewManager.cpp#2627
2627       nsView* parentView = view->GetParent();
2628       UpdateView(parentView, oldArea, NS_VMREFRESH_NO_SYNC);

I hit a null pointer there with XULMaker (from xulmaker.mozdev.org). I reduced
it to a test case which I'm going to attach. I got several people to test it on
recent nightly builds, and it seems to happen only in Linux (haven't had any mac
testers yet) with the gtk1 toolkit.

The XUL places a menulist with editable="true" in an arrowscrollbox in a
toolbar.  With this combination, we end up with an nsScrollPortView with a null
parent.  I will attach a file containing the backtrace and the contents of the
nsScrollPortView.  I can fetch other information as required (catch me in
irc://irc.mozilla.org/mozilla where I go by sirLurxalot).

I am filing a bug about the unchecked dereference above, but that's just a
symptom of this bug.

Interesting bits of fun:
 - I can remove the editable attribute and it works fine
 - I can set editable to any value (including false and "") and it crashes
 - I can remove the arrowscrollbox and it works fine
I haven't tried any other combinations.
(Reporter)

Comment 1

15 years ago
Created attachment 126632 [details]
Test case

This crashes on Linux for me and at least one other tester (gtk1 build).
(Reporter)

Comment 2

15 years ago
Created attachment 126633 [details]
Stack trace, contents of nsScrollPortView
(Reporter)

Comment 3

15 years ago
Oh, you may have to load the XUL as chrome (with -chrome) to trigger the
problem.  As I just found out, it might also work by loading it into an Object
(go to Edit the test case attachment).

The null pointer dereference bug is bug 210920.

Comment 4

15 years ago
dupe of "mozilla crash when displaying editable <menulist> that is in the
<menupopup>"

*** This bug has been marked as a duplicate of 209365 ***
Status: NEW → RESOLVED
Last Resolved: 15 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.