Closed Bug 380217 Opened 13 years ago Closed 13 years ago
Crash [@ ns
Tree Box Object::Get Columns] with <xul:tree> and position: fixed
Loading the testcase in Mac trunk debug causes Firefox to crash [@ nsTreeBoxObject::GetColumns] dereferencing 0xdddddddd.
It is ugly that treebodyframe implements nsITreeBoxObject, box objects are usually refcounted, but not in this case. (Though, treebodyframe's nsITreeBoxObject is accessed only through the real treeboxobject). Anyway, seems to me that ClearCachedValues() doesn't get called for some reason.
I can't reproduce the bug on branch, so it would be good to find the regression range. Anyway, I think EnsureBoxObject should be called already in ::Init, because it must be sure that boxObject's ClearCachedValues() is called in ::Destroy. And if EnsureBoxObject is called already in ::Init, there is no reason to call it elsewhere (mTreeBoxObject is set to null only in ::Destroy).
I'm getting a crash when clicking 2 times on the treecolpicker, is that the same bug or something else?
I get that crash if I backout bug 377035 and don't use the patch in this bug. But with this patch (and no need to backout 377035) I don't get the crash.
The stack for the double click crash is totally different, but because the patch helps with that, maybe the patch could be useful also on branches.
Note that I don't see a treecolpicker on branches, so I can't test if it crashes there.
treecolpicker is there, behind the scrollbar. I can see basically the border of it, so only few pixels.
I tested the patch on branch and it doesn't help with the double click crash there. Need to file a new bug for that.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Whiteboard: [sg:critical?] → [sg:critical?] post 1.8-branch
Crashtest checked in.
Flags: in-testsuite? → in-testsuite+
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: xptoolkit.trees → xptoolkit.widgets
Crash Signature: [@ nsTreeBoxObject::GetColumns]
You need to log in before you can comment on or make changes to this bug.