Crash [@ inLayoutUtils::GetContainerFor] when following these steps in DOM inspector

RESOLVED WORKSFORME

Status

Other Applications
DOM Inspector
--
critical
RESOLVED WORKSFORME
13 years ago
7 years ago

People

(Reporter: Martijn Wargers (zombie), Unassigned)

Tracking

({crash, regression, testcase})

Trunk
crash, regression, testcase

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

13 years ago
See upcoming testcase:

To reproduce, open testcase:
1. - Open DOM Inspector
2. - Remove html document type of iframe (yellow colored "html" just under #document)
3. - Remove iframe
4. - Press Ctrl-z (undo)
5. - Press Ctrl-z (undo)
-> Crash

Talkback Id: TB11560652X

inLayoutUtils::GetContainerFor  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/extensions/inspector/base/src/inLayoutUtils.cpp, line 252]
inDOMUtils::GetParentForNode  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/extensions/inspector/base/src/inDOMUtils.cpp, line 130]
inDeepTreeWalker::ParentNode  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/extensions/inspector/base/src/inDeepTreeWalker.cpp, line 188]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2139]
XPC_WN_CallMethod  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3523]
js_Invoke  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
js_Interpret  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3523]
js_Invoke  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
nsXPCWrappedJSClass::CallMethod  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1369]
nsXPCWrappedJS::CallMethod  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 462]
SharedStub  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsTransactionItem::UndoTransaction  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/editor/txmgr/src/nsTransactionItem.cpp, line 197]
nsTransactionManager::`vftable'
nsTransactionManager::AddRef  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/editor/txmgr/src/nsTransactionManager.cpp, line 104]
0x8b560c45
(Reporter)

Comment 1

13 years ago
Created attachment 202128 [details]
testcase
(Reporter)

Comment 2

13 years ago
Well, it seems a regression, somewhere between 2005-06-15 and 2005-07-01. Builds between those dates crash, when unfolding certain elements in the dom inspector, so I can't really pinpoint the regression date.

Note that with builds before the regression range, the "(yellow colored "html" just under
#document)" thing in step 2 doesn't seem to get deleted, while it seems that that happens in builds after the regression range.
(Reporter)

Updated

13 years ago
Keywords: regression

Comment 3

12 years ago
Believe it or not, Martijn, but backing out your patch in bug 297660 fixes the crash. But, it does not, however, cause the deleted html document node to be restored.
OS: Windows XP → All
Hardware: PC → All
Version: unspecified → Trunk
(Reporter)

Comment 4

12 years ago
Uhm, that's interesting...
But it's not like that patch did something weird. I guess it just exposed something that was already broken.
Blocks: 297660
(Reporter)

Comment 5

12 years ago
Ok, this is worksforme now with current trunk build. I suspect this was fixed with the fix for bug 285204, but I'm too lazy to check.
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → WORKSFORME
Assignee: dom-inspector → nobody
QA Contact: timeless → dom-inspector
(Assignee)

Updated

7 years ago
Crash Signature: [@ inLayoutUtils::GetContainerFor]
You need to log in before you can comment on or make changes to this bug.