381167 - Crash [@ nsTreeBodyFrame::GetColumns] on closing tab with tree stuff

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

Bug 380217 should be fixed in the nightly 2007-05-18 trunk build, right?
I'm still crashing with that build when closing the tab with the attached testcase.

Talkback ID: TB32268523G
0x00000000
nsTreeBodyFrame::GetColumns  [mozilla/layout/xul/base/src/tree/src/nstreebodyframe.cpp, line 572]
nsTreeColFrame::Destroy  [mozilla/layout/xul/base/src/tree/src/nstreecolframe.cpp, line 103]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nslinebox.cpp, line 363]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
CanvasFrame::Destroy  [mozilla/layout/generic/nshtmlframe.cpp, line 211]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameManager::Destroy  [mozilla/layout/base/nsframemanager.cpp, line 282]
DocumentViewerImpl::Hide  [mozilla/layout/base/nsdocumentviewer.cpp, line 2041]
nsDocShell::SetVisibility  [mozilla/docshell/base/nsdocshell.cpp, line 3752]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsBoxFrame::RemoveFrame  [mozilla/layout/xul/base/src/nsboxframe.cpp, line 1008]
nsFrameManager::RemoveFrame  [mozilla/layout/base/nsframemanager.cpp, line 692]
nsCSSFrameConstructor::ContentRemoved  [mozilla/layout/base/nscssframeconstructor.cpp, line 9566]
PresShell::ContentRemoved  [mozilla/layout/base/nspresshell.cpp, line 4474]
nsNodeUtils::ContentRemoved  [mozilla/content/base/src/nsnodeutils.cpp, line 150]
nsGenericElement::doRemoveChildAt  [mozilla/content/base/src/nsgenericelement.cpp, line 2450]
nsGenericElement::RemoveChildAt  [mozilla/content/base/src/nsgenericelement.cpp, line 2399]
nsXULElement::RemoveChildAt  [mozilla/content/xul/content/src/nsxulelement.cpp, line 907]
nsGenericElement::doRemoveChild  [mozilla/content/base/src/nsgenericelement.cpp, line 3013]
nsGenericElement::RemoveChild  [mozilla/content/base/src/nsgenericelement.cpp, line 2583]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2245]

It also crashes in branch builds, so I'm marking it security sensitve for now.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

This is something else than Bug 380217.
Taking

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Attachment: proposed patch

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for branch

Or should it be approval1.8.1.4?

Comment 4

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070524 Minefield/3.0a5pre

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 265491 [details] [diff] [review]
for branch

approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers

Comment 6

[Carsten Book [:Tomcat]]

verified fixed 1.8.1.5 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.5pre) Gecko/20070704 BonEcho/2.0.0.5pre ID:2007070403 and tested with the  testcase in this bug. No crash on Testcase during testings - adding verified keyword

Comment 7

[Carsten Book [:Tomcat]]

verified 1.8.0.13 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.13pre) Gecko/20070822 Firefox/1.5.0.13pre - no crash on testcase - adding verified keyword

Comment 8

[Bob Clary [:bc] (inactive)]

mochitest landed
http://hg.mozilla.org/mozilla-central/rev/7f42099b2402