330170 - crash in history tab of Side bar [@ nsXULTreeBuilder::CycleHeader]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[baffclan]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060310 SeaMonkey/1.5a
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060310 SeaMonkey/1.5a

crash in history tab of Side bar

Reproducible: Always

Steps to Reproduce:
1. Open sidebar
2. Click history tab
3. click right column of the column header
   and check Location item.
4. Drag Location Column, drop left of Titel Column.
5. Click a Location Column.





TB16227988Z, TB16227975W, TB16227749Q, TB16227730Q

Comment 1

[baffclan]

Incident ID: 16227749
Stack Signature	nsXULTreeBuilder::CycleHeader 12a1a888
Product ID	MozillaTrunk
Build ID	2006031009
Trigger Time	2006-03-11 06:52:00.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	gklayout.dll + (001b6678)
URL visited	
User Comments	
Since Last Crash	17 sec
Total Uptime	10087 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp, line 919
Stack Trace 	
nsXULTreeBuilder::CycleHeader  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp, line 919]
XPTC_InvokeByIndex  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152]
XPC_WN_CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1246]
js_Interpret  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3886]
js_Invoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1270]
js_InternalInvoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1347]
JS_CallFunctionValue  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 4189]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1426]
nsJSEventListener::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsXBLPrototypeHandler::ExecuteHandler  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp, line 507]
nsXBLEventHandler::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLEventHandler.cpp, line 86]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1653]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1760]
nsEventTargetChainItem::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 335]
nsEventTargetChainItem::HandleEventTargetChain  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 455]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 405]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventDispatcher::Dispatch  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 575]
PresShell::HandleEventInternal  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6117]
PresShell::HandleEventWithTarget  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6014]
nsEventStateManager::CheckForAndDispatchClick  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 3030]
nsEventStateManager::PostHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 2013]
PresShell::HandleEventInternal  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6135]
PresShell::HandlePositionedEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5996]
PresShell::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5824]
nsViewManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1712]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1665]
HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1053]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 6019]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 6201]
nsWindow::WindowProc  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1242]
USER32.dll + 0x8734 (0x77cf8734)
USER32.dll + 0x8816 (0x77cf8816)
USER32.dll + 0x89cd (0x77cf89cd)
USER32.dll + 0x8a10 (0x77cf8a10)
nsAppShell::Run  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp, line 208]
main  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1750]
WinMain  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1774]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 2

[Hartmut Figge]

This bug happens also on
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20060312 SeaMonkey/1.5a Mnenhy/0.7.3.10002

Comment 3

[timeless]

Attachment: validate arguments, label arguments, use Truncate

Comment 4

[[e-mail]]

Attachment: Actually fix the bug

The previous patch, although useful, only wallpapers over the actual bug.

This is actually a regression from bug 212789. Prior to that bug, the <treecol>s were enumerated in visual order by walking the child frames of the <treecols>. While that bug introduced extra frames in to the mix, it changed to walking the sibling frames of the first <treecol>. However, if the first <treecol> is not leftmost then the columns on its left get ignored and are not enumerated.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 214826 [details] [diff] [review]
Actually fix the bug

Add a comment explaining the weird code pattern, ok?

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 214813 [details] [diff] [review]
validate arguments, label arguments, use Truncate

This is kinda big; I won't be able to get to it before April, probably.  :(

Comment 7

[[e-mail]]

Comment on attachment 214813 [details] [diff] [review]
validate arguments, label arguments, use Truncate

>+    NS_ENSURE_ARG_POINTER(aResource);
By my totally arbitrary scan of existing source, we seem to use NS_ENSURE_ARG for in args, and NS_ENSURE_ARG_POINTER for out args (in which case I suppose we could optimize away NS_ENSURE_ARG_POINTER in release builds because xpconnnect can never pass a null out pointer).

>+nsXULTreeBuilder::CycleCell(PRInt32 aRow, nsITreeColumn* oCol)
Typo "oCol".

Comment 8

[timeless]

Comment on attachment 214813 [details] [diff] [review]
validate arguments, label arguments, use Truncate

mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp 	1.91

Comment 9

[baffclan]

cannot reproduce with SeaMonkey/2006041909-trunk/WinXP

Comment 10

[Hideo Oshima]

Can anyone still reproduce this problem?
If not, I will mark this as worksforme.

Comment 11

[timeless]

please don't mark bugs that have patches and cvs commits as worksforme. at this point, we thank you for your input, and eventually we'll resolve the bug as fixed.

Comment 12

[[e-mail]]

Comment on attachment 214826 [details] [diff] [review]
Actually fix the bug

I forgot that the fix for bug 330236 also depends on this...

Comment 13

[Neil Deakin]

Comment on attachment 214826 [details] [diff] [review]
Actually fix the bug

Looks good, in fact slightly better than the similar change I made for bug 201499.

Comment 14

[[e-mail]]

Fix checked in.

Comment 15

[:Gavin Sharp [email: [e-mail]]]

Neil: are you going to check this in on the 1.8 branch?

Comment 16

[[e-mail]]

Sorry, I didn't notice the flag change.

Comment 17

[[e-mail]]

Fix checked in to the branch.

Comment 18

[[e-mail]]

On second thoughts, this patch isn't needed on the branch :-[

Comment 19

[Mike Schroepfer]

Comment on attachment 214826 [details] [diff] [review]
Actually fix the bug

Clearing approval flag per last comment