Last Comment Bug 381167 - Crash [@ nsTreeBodyFrame::GetColumns] on closing tab with tree stuff
: Crash [@ nsTreeBodyFrame::GetColumns] on closing tab with tree stuff
Status: VERIFIED FIXED
[sg:critical?] deleted tree body
: crash, testcase, verified1.8.0.13, verified1.8.1.5
Product: Core
Classification: Components
Component: XUL (show other bugs)
: Trunk
: x86 Windows XP
: -- critical (vote)
: ---
Assigned To: Olli Pettay [:smaug]
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2007-05-18 08:56 PDT by Martijn Wargers [:mwargers] (gone per 2016-05-31 :-( )
Modified: 2011-06-13 10:01 PDT (History)
6 users (show)
dveditz: blocking1.8.1.5+
dveditz: wanted1.8.1.x+
dveditz: blocking1.8.0.13+
dveditz: wanted1.8.0.x+
bob: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (225 bytes, application/xhtml+xml)
2007-05-18 08:56 PDT, Martijn Wargers [:mwargers] (gone per 2016-05-31 :-( )
no flags Details
proposed patch (1.32 KB, patch)
2007-05-18 14:42 PDT, Olli Pettay [:smaug]
roc: review+
roc: superreview+
Details | Diff | Review
for branch (1.26 KB, patch)
2007-05-21 01:23 PDT, Olli Pettay [:smaug]
dveditz: approval1.8.1.5+
dveditz: approval1.8.0.13+
Details | Diff | Review

Description Martijn Wargers [:mwargers] (gone per 2016-05-31 :-( ) 2007-05-18 08:56:02 PDT
Created attachment 265264 [details]
testcase

Bug 380217 should be fixed in the nightly 2007-05-18 trunk build, right?
I'm still crashing with that build when closing the tab with the attached testcase.

Talkback ID: TB32268523G
0x00000000
nsTreeBodyFrame::GetColumns  [mozilla/layout/xul/base/src/tree/src/nstreebodyframe.cpp, line 572]
nsTreeColFrame::Destroy  [mozilla/layout/xul/base/src/tree/src/nstreecolframe.cpp, line 103]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nslinebox.cpp, line 363]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
CanvasFrame::Destroy  [mozilla/layout/generic/nshtmlframe.cpp, line 211]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameManager::Destroy  [mozilla/layout/base/nsframemanager.cpp, line 282]
DocumentViewerImpl::Hide  [mozilla/layout/base/nsdocumentviewer.cpp, line 2041]
nsDocShell::SetVisibility  [mozilla/docshell/base/nsdocshell.cpp, line 3752]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsframelist.cpp, line 60]
nsBoxFrame::RemoveFrame  [mozilla/layout/xul/base/src/nsboxframe.cpp, line 1008]
nsFrameManager::RemoveFrame  [mozilla/layout/base/nsframemanager.cpp, line 692]
nsCSSFrameConstructor::ContentRemoved  [mozilla/layout/base/nscssframeconstructor.cpp, line 9566]
PresShell::ContentRemoved  [mozilla/layout/base/nspresshell.cpp, line 4474]
nsNodeUtils::ContentRemoved  [mozilla/content/base/src/nsnodeutils.cpp, line 150]
nsGenericElement::doRemoveChildAt  [mozilla/content/base/src/nsgenericelement.cpp, line 2450]
nsGenericElement::RemoveChildAt  [mozilla/content/base/src/nsgenericelement.cpp, line 2399]
nsXULElement::RemoveChildAt  [mozilla/content/xul/content/src/nsxulelement.cpp, line 907]
nsGenericElement::doRemoveChild  [mozilla/content/base/src/nsgenericelement.cpp, line 3013]
nsGenericElement::RemoveChild  [mozilla/content/base/src/nsgenericelement.cpp, line 2583]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2245]

It also crashes in branch builds, so I'm marking it security sensitve for now.
Comment 1 Olli Pettay [:smaug] 2007-05-18 09:33:59 PDT
This is something else than Bug 380217.
Taking
Comment 2 Olli Pettay [:smaug] 2007-05-18 14:42:43 PDT
Created attachment 265304 [details] [diff] [review]
proposed patch
Comment 3 Olli Pettay [:smaug] 2007-05-21 01:23:04 PDT
Created attachment 265491 [details] [diff] [review]
for branch

Or should it be approval1.8.1.4?
Comment 4 Martijn Wargers [:mwargers] (gone per 2016-05-31 :-( ) 2007-05-24 08:38:53 PDT
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070524 Minefield/3.0a5pre
Comment 5 Daniel Veditz [:dveditz] 2007-06-15 10:51:24 PDT
Comment on attachment 265491 [details] [diff] [review]
for branch

approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers
Comment 6 Carsten Book [:Tomcat] 2007-07-04 11:59:56 PDT
verified fixed 1.8.1.5 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.5pre) Gecko/20070704 BonEcho/2.0.0.5pre ID:2007070403 and tested with the  testcase in this bug. No crash on Testcase during testings - adding verified keyword
Comment 7 Carsten Book [:Tomcat] 2007-08-23 08:05:55 PDT
verified 1.8.0.13 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.13pre) Gecko/20070822 Firefox/1.5.0.13pre - no crash on testcase - adding verified keyword
Comment 8 Bob Clary [:bc:] 2009-04-24 10:48:13 PDT
mochitest landed
http://hg.mozilla.org/mozilla-central/rev/7f42099b2402

Note You need to log in before you can comment on or make changes to this bug.