Closed Bug 381167 Opened 13 years ago Closed 13 years ago

Crash [@ nsTreeBodyFrame::GetColumns] on closing tab with tree stuff

Categories

(Core :: XUL, defect, critical)

x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: smaug)

Details

(4 keywords, Whiteboard: [sg:critical?] deleted tree body)

Crash Data

Attachments

(3 files)

Attached file testcase
Bug 380217 should be fixed in the nightly 2007-05-18 trunk build, right?
I'm still crashing with that build when closing the tab with the attached testcase.

Talkback ID: TB32268523G
0x00000000
nsTreeBodyFrame::GetColumns  [mozilla/layout/xul/base/src/tree/src/nstreebodyframe.cpp, line 572]
nsTreeColFrame::Destroy  [mozilla/layout/xul/base/src/tree/src/nstreecolframe.cpp, line 103]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nslinebox.cpp, line 363]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
CanvasFrame::Destroy  [mozilla/layout/generic/nshtmlframe.cpp, line 211]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameManager::Destroy  [mozilla/layout/base/nsframemanager.cpp, line 282]
DocumentViewerImpl::Hide  [mozilla/layout/base/nsdocumentviewer.cpp, line 2041]
nsDocShell::SetVisibility  [mozilla/docshell/base/nsdocshell.cpp, line 3752]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsBoxFrame::RemoveFrame  [mozilla/layout/xul/base/src/nsboxframe.cpp, line 1008]
nsFrameManager::RemoveFrame  [mozilla/layout/base/nsframemanager.cpp, line 692]
nsCSSFrameConstructor::ContentRemoved  [mozilla/layout/base/nscssframeconstructor.cpp, line 9566]
PresShell::ContentRemoved  [mozilla/layout/base/nspresshell.cpp, line 4474]
nsNodeUtils::ContentRemoved  [mozilla/content/base/src/nsnodeutils.cpp, line 150]
nsGenericElement::doRemoveChildAt  [mozilla/content/base/src/nsgenericelement.cpp, line 2450]
nsGenericElement::RemoveChildAt  [mozilla/content/base/src/nsgenericelement.cpp, line 2399]
nsXULElement::RemoveChildAt  [mozilla/content/xul/content/src/nsxulelement.cpp, line 907]
nsGenericElement::doRemoveChild  [mozilla/content/base/src/nsgenericelement.cpp, line 3013]
nsGenericElement::RemoveChild  [mozilla/content/base/src/nsgenericelement.cpp, line 2583]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2245]

It also crashes in branch builds, so I'm marking it security sensitve for now.
This is something else than Bug 380217.
Taking
Assignee: Jan.Varga → Olli.Pettay
Attached patch proposed patchSplinter Review
Attachment #265304 - Flags: superreview?(roc)
Attachment #265304 - Flags: review?(roc)
Attachment #265304 - Flags: superreview?(roc)
Attachment #265304 - Flags: superreview+
Attachment #265304 - Flags: review?(roc)
Attachment #265304 - Flags: review+
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Attached patch for branchSplinter Review
Or should it be approval1.8.1.4?
Attachment #265491 - Flags: approval1.8.1.5?
Attachment #265491 - Flags: approval1.8.0.13?
Flags: wanted1.8.1.x+
Flags: wanted1.8.0.x+
Flags: blocking1.8.1.5?
Flags: blocking1.8.0.13?
Whiteboard: [sg:critical?] deleted tree body
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070524 Minefield/3.0a5pre
Status: RESOLVED → VERIFIED
Flags: blocking1.8.1.5?
Flags: blocking1.8.1.5+
Flags: blocking1.8.0.13?
Flags: blocking1.8.0.13+
Comment on attachment 265491 [details] [diff] [review]
for branch

approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers
Attachment #265491 - Flags: approval1.8.1.5?
Attachment #265491 - Flags: approval1.8.1.5+
Attachment #265491 - Flags: approval1.8.0.13?
Attachment #265491 - Flags: approval1.8.0.13+
verified fixed 1.8.1.5 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.5pre) Gecko/20070704 BonEcho/2.0.0.5pre ID:2007070403 and tested with the  testcase in this bug. No crash on Testcase during testings - adding verified keyword
verified 1.8.0.13 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.13pre) Gecko/20070822 Firefox/1.5.0.13pre - no crash on testcase - adding verified keyword
Group: security
Flags: in-testsuite?
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: xptoolkit.trees → xptoolkit.widgets
mochitest landed
http://hg.mozilla.org/mozilla-central/rev/7f42099b2402
Flags: in-testsuite? → in-testsuite+
Crash Signature: [@ nsTreeBodyFrame::GetColumns]
You need to log in before you can comment on or make changes to this bug.