210919 - Editable menulist in arrowscrollbox results in an nsScrollPortView with no parent view

Status: RESOLVED DUPLICATE of bug 209365

(Core :: Layout, defect)

Description

[Tim]

http://lxr.mozilla.org/seamonkey/source/view/src/nsViewManager.cpp#2627
2627       nsView* parentView = view->GetParent();
2628       UpdateView(parentView, oldArea, NS_VMREFRESH_NO_SYNC);

I hit a null pointer there with XULMaker (from xulmaker.mozdev.org). I reduced
it to a test case which I'm going to attach. I got several people to test it on
recent nightly builds, and it seems to happen only in Linux (haven't had any mac
testers yet) with the gtk1 toolkit.

The XUL places a menulist with editable="true" in an arrowscrollbox in a
toolbar.  With this combination, we end up with an nsScrollPortView with a null
parent.  I will attach a file containing the backtrace and the contents of the
nsScrollPortView.  I can fetch other information as required (catch me in
irc://irc.mozilla.org/mozilla where I go by sirLurxalot).

I am filing a bug about the unchecked dereference above, but that's just a
symptom of this bug.

Interesting bits of fun:
 - I can remove the editable attribute and it works fine
 - I can set editable to any value (including false and "") and it crashes
 - I can remove the arrowscrollbox and it works fine
I haven't tried any other combinations.

Comment 1

[Tim]

Attachment: Test case

This crashes on Linux for me and at least one other tester (gtk1 build).

Comment 2

[Tim]

Attachment: Stack trace, contents of nsScrollPortView

Comment 3

[Tim]

Oh, you may have to load the XUL as chrome (with -chrome) to trigger the
problem.  As I just found out, it might also work by loading it into an Object
(go to Edit the test case attachment).

The null pointer dereference bug is bug 210920.

Comment 4

[Andrew Schultz]

dupe of "mozilla crash when displaying editable <menulist> that is in the
<menupopup>"

*** This bug has been marked as a duplicate of 209365 ***