374103 - Crash [@ nsTreeBodyFrame::SetView] on branch with testcase from bug 374102

Status: RESOLVED DUPLICATE of bug 140218

(Core :: XUL, defect)

Description

[Martijn Wargers (dead)]

The testcase from bug 374102 crashes 1.8 builds directly.

Talkback ID: TB30268264W
nsTreeBodyFrame::SetView  [mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 532]
nsTreeBodyFrame::EnsureView  [mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 421]
nsTreeBodyFrame::GetMinSize  [mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 220]
nsBox::GetPrefSize  [mozilla/layout/xul/base/src/nsBox.cpp, line 703]
nsBox::GetAscent  [mozilla/layout/xul/base/src/nsBox.cpp, line 781]
nsStackLayout::GetAscent  [mozilla/layout/xul/base/src/nsStackLayout.cpp, line 181]
nsBoxFrame::GetAscent  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 987]
nsSprocketLayout::GetAscent  [mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1591]
nsBoxFrame::GetAscent  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 987]
nsSprocketLayout::Layout  [mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 260]
nsBoxFrame::DoLayout  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsBoxFrame::DoLayout  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsRootBoxFrame::Reflow  [mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 227]
nsContainerFrame::ReflowChild  [mozilla/layout/generic/nsContainerFrame.cpp, line 905]
ViewportFrame::Reflow  [mozilla/layout/generic/nsViewportFrame.cpp, line 240]
PresShell::InitialReflow  [mozilla/layout/base/nsPresShell.cpp, line 2907]
nsXULDocument::StartLayout  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 2283]
nsXULDocument::ResumeWalk  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 3363]
nsXULDocument::EndLoad  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 739]
XULContentSinkImpl::DidBuildModel  [mozilla/content/xul/document/src/nsXULContentSink.cpp, line 408]
nsExpatDriver::DidBuildModel  [mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 1227]

Comment 2

[:Gavin Sharp [email: [e-mail]]]

Attachment: patch

With this patch (which I think is correct, given the other callers of GetBaseElement()), the testcase now triggers bug 140218.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Attachment: patch

(this is the actual patch, oops)

Comment 4

[Daniel Veditz [:dveditz]]

-> Gavin since he's done some work on this

Comment 5

[:Gavin Sharp [email: [e-mail]]]

Actually, I didn't notice the first patch in bug 140218, it's the same one I attached here. I've posted a rollup branch patch to that bug.