380853 - Double clicking treecolpicker crashes (with <xul:tree> and position: fixed)

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

Testcase is from Bug 380217.
The treecolpicker might be under the scrollbar, but if the
scrollbar is narrow enough you should see at least some part of it.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

There is an assertion before the crash
###!!! ASSERTION: A box layout method was called but InitBoxMetrics was never called: 'metrics', file /home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/layout/generic/nsFrame.cpp, line 5767

(Using 1.8 for testing)

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

As far as I see, this is a null pointer crash, so perhaps 
|Security-Sensitive| isn't needed.
But this needs still a bit more investigation.

Comment 3

[Jesse Ruderman]

Smaug, it would be great if you could fix this or at least determine whether it's a security hole before Gecko 1.9.

Comment 4

[Mike Schroepfer]

Moving off the blocking list.  If comment 2 is wrong please re-nom

Comment 5

[Martijn Wargers (dead)]

Afaict, this was a branch crasher only, anyway.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

I don't remember whether this was branch only, but at least I can't reproduce
the crash on trunk anymore.
And the crash was always a nullpointer crash.

Comment 7

[Lucas Adamski [:ladamski]]

Can't repro in 2.0.0.17 or 3.0.3.

Comment 8

[Brandon Sterne (:bsterne)]

I can't reproduce this on the 1.8 branch either, so given comment 6 and comment 7 I'm going to resolve this WORKSFORME.