Crash [@ nsTreeBodyFrame::GetColumns] on closing tab with tree stuff

VERIFIED FIXED

Status

()

Core
XUL
--
critical
VERIFIED FIXED
10 years ago
6 years ago

People

(Reporter: Martijn Wargers (dead), Assigned: smaug)

Tracking

(4 keywords)

Trunk
x86
Windows XP
crash, testcase, verified1.8.0.13, verified1.8.1.5
Points:
---
Bug Flags:
blocking1.8.1.5 +
wanted1.8.1.x +
blocking1.8.0.13 +
wanted1.8.0.x +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical?] deleted tree body, crash signature)

Attachments

(3 attachments)

(Reporter)

Description

10 years ago
Created attachment 265264 [details]
testcase

Bug 380217 should be fixed in the nightly 2007-05-18 trunk build, right?
I'm still crashing with that build when closing the tab with the attached testcase.

Talkback ID: TB32268523G
0x00000000
nsTreeBodyFrame::GetColumns  [mozilla/layout/xul/base/src/tree/src/nstreebodyframe.cpp, line 572]
nsTreeColFrame::Destroy  [mozilla/layout/xul/base/src/tree/src/nstreecolframe.cpp, line 103]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nslinebox.cpp, line 363]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
CanvasFrame::Destroy  [mozilla/layout/generic/nshtmlframe.cpp, line 211]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameManager::Destroy  [mozilla/layout/base/nsframemanager.cpp, line 282]
DocumentViewerImpl::Hide  [mozilla/layout/base/nsdocumentviewer.cpp, line 2041]
nsDocShell::SetVisibility  [mozilla/docshell/base/nsdocshell.cpp, line 3752]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsBoxFrame::RemoveFrame  [mozilla/layout/xul/base/src/nsboxframe.cpp, line 1008]
nsFrameManager::RemoveFrame  [mozilla/layout/base/nsframemanager.cpp, line 692]
nsCSSFrameConstructor::ContentRemoved  [mozilla/layout/base/nscssframeconstructor.cpp, line 9566]
PresShell::ContentRemoved  [mozilla/layout/base/nspresshell.cpp, line 4474]
nsNodeUtils::ContentRemoved  [mozilla/content/base/src/nsnodeutils.cpp, line 150]
nsGenericElement::doRemoveChildAt  [mozilla/content/base/src/nsgenericelement.cpp, line 2450]
nsGenericElement::RemoveChildAt  [mozilla/content/base/src/nsgenericelement.cpp, line 2399]
nsXULElement::RemoveChildAt  [mozilla/content/xul/content/src/nsxulelement.cpp, line 907]
nsGenericElement::doRemoveChild  [mozilla/content/base/src/nsgenericelement.cpp, line 3013]
nsGenericElement::RemoveChild  [mozilla/content/base/src/nsgenericelement.cpp, line 2583]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2245]

It also crashes in branch builds, so I'm marking it security sensitve for now.
(Assignee)

Comment 1

10 years ago
This is something else than Bug 380217.
Taking
Assignee: Jan.Varga → Olli.Pettay
(Assignee)

Comment 2

10 years ago
Created attachment 265304 [details] [diff] [review]
proposed patch
Attachment #265304 - Flags: superreview?(roc)
Attachment #265304 - Flags: review?(roc)
Attachment #265304 - Flags: superreview?(roc)
Attachment #265304 - Flags: superreview+
Attachment #265304 - Flags: review?(roc)
Attachment #265304 - Flags: review+
(Assignee)

Updated

10 years ago
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
(Assignee)

Comment 3

10 years ago
Created attachment 265491 [details] [diff] [review]
for branch

Or should it be approval1.8.1.4?
Attachment #265491 - Flags: approval1.8.1.5?
Attachment #265491 - Flags: approval1.8.0.13?
Flags: wanted1.8.1.x+
Flags: wanted1.8.0.x+
Flags: blocking1.8.1.5?
Flags: blocking1.8.0.13?
Whiteboard: [sg:critical?] deleted tree body
(Reporter)

Comment 4

10 years ago
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070524 Minefield/3.0a5pre
Status: RESOLVED → VERIFIED
Flags: blocking1.8.1.5?
Flags: blocking1.8.1.5+
Flags: blocking1.8.0.13?
Flags: blocking1.8.0.13+
Comment on attachment 265491 [details] [diff] [review]
for branch

approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers
Attachment #265491 - Flags: approval1.8.1.5?
Attachment #265491 - Flags: approval1.8.1.5+
Attachment #265491 - Flags: approval1.8.0.13?
Attachment #265491 - Flags: approval1.8.0.13+
(Assignee)

Updated

10 years ago
Keywords: fixed1.8.0.13, fixed1.8.1.5
verified fixed 1.8.1.5 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.5pre) Gecko/20070704 BonEcho/2.0.0.5pre ID:2007070403 and tested with the  testcase in this bug. No crash on Testcase during testings - adding verified keyword
Keywords: fixed1.8.1.5 → verified1.8.1.5
verified 1.8.0.13 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.13pre) Gecko/20070822 Firefox/1.5.0.13pre - no crash on testcase - adding verified keyword
Keywords: fixed1.8.0.13 → verified1.8.0.13
Group: security
Flags: in-testsuite?

Updated

9 years ago
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: xptoolkit.trees → xptoolkit.widgets

Comment 8

8 years ago
mochitest landed
http://hg.mozilla.org/mozilla-central/rev/7f42099b2402
Flags: in-testsuite? → in-testsuite+
Crash Signature: [@ nsTreeBodyFrame::GetColumns]
You need to log in before you can comment on or make changes to this bug.