307298 - Crash moving XUL <treeitem> out of <tree> [@ nsTreeContentView::InsertRowFor]

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20050906
Firefox/1.6a1

Comment 1

[Jesse Ruderman]

Attachment: fairly simple testcase (click the "Crash" button at the bottom)

Comment 2

[Jesse Ruderman]

TB9101664H

Comment 3

[Bruno 'Aqualon' Escherl]

Crashes Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050901
SeaMonkey/1.1a, TB9107449H

Comment 4

[[e-mail]]

Attachment: Fix bogus loop in ContentInserted (and ContentRemoved)

Comment 5

[[e-mail]]

Comment on attachment 196363 [details] [diff] [review]
Fix bogus loop in ContentInserted (and ContentRemoved)

Seeking approval for crash fix.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using SeaMonkey 1.1a: Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.9a1) Gecko/20050922 Mozilla/1.0

Comment 7

[Asa Dotzler [:asa]]

neil, or jesse, can you tell us more about the impact of this bug? It's not
labeled as a topcrash so I'm certainly interested in hearing about the risk and
who would be affected by this crash. 

Comment 8

[Mike Schroepfer]

Comment on attachment 196363 [details] [diff] [review]
Fix bogus loop in ContentInserted (and ContentRemoved)

Approved per 9/26 bug triage meeting.

Comment 9

[Jay Patel [:jay]]

v.fixed on branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5)
Gecko/20050928 Firefox/1.4, no crash with testcase.

Comment 10

[Jesse Ruderman]

Crashtest is in.  On Intel Mac, a 2005-09-06 nightly hangs instead of crashing (with both the testcase in this bug and the testcase I checked in), but that's close enough.