380217 - Crash [@ nsTreeBoxObject::GetColumns] with <xul:tree> and position: fixed

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase in Mac trunk debug causes Firefox to crash [@ nsTreeBoxObject::GetColumns] dereferencing 0xdddddddd.

Comment 1

[Mats Palmgren (inactive)]

Attachment: stack

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

It is ugly that treebodyframe implements nsITreeBoxObject, box objects 
are usually refcounted, but not in this case. (Though, treebodyframe's nsITreeBoxObject is accessed only through the real treeboxobject).
Anyway, seems to me that ClearCachedValues() doesn't get called for some reason.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: possible patch

I can't reproduce the bug on branch, so it would be good to find the
regression range. Anyway, I think EnsureBoxObject should be called already in ::Init, because it must be sure that boxObject's
ClearCachedValues() is called in ::Destroy.
And if EnsureBoxObject is called already in ::Init, there is no reason 
to call it elsewhere (mTreeBoxObject is set to null only in ::Destroy).

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

This is a regression from bug 377035.

Comment 5

[Martijn Wargers (dead)]

I'm getting a crash when clicking 2 times on the treecolpicker, is that the same bug or something else?

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

I get that crash if I backout bug 377035 and don't use the patch in this
bug. But with this patch (and no need to backout 377035) I don't get the crash.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

The stack for the double click crash is totally different, but because the patch helps with that, maybe the patch could be useful also on
branches.

Comment 8

[Martijn Wargers (dead)]

Note that I don't see a treecolpicker on branches, so I can't test if it crashes there.

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

treecolpicker is there, behind the scrollbar.
I can see basically the border of it, so only few pixels.

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

I tested the patch on branch and it doesn't help with the double click 
crash there. Need to file a new bug for that.

Comment 11

[Olli Pettay [:smaug][[e-mail]]]

(In reply to comment #10)
>  Need to file a new bug for that.
> 
Bug 380853

Comment 12

[Jesse Ruderman]

Crashtest checked in.