381862 - Crash [@ nsBoxFrame::BuildDisplayListForChildren] with tree stuff in iframe toggling display

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk Mozilla builds.
This seems to have regressed between 2007-04-26 and 2007-04-27:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-04-26+04&maxdate=2007-04-27+09&cvsroot=%2Fcvsroot
Although that might be nonsense, because I think I have cases where it crashes earlier.

Talkback ID: TB32466691W
nsBoxFrame::BuildDisplayListForChildren  [mozilla/layout/xul/base/src/nsboxframe.cpp, line 1266]
nsTreeColFrame::BuildDisplayListForChildren  [mozilla/layout/xul/base/src/tree/src/nstreecolframe.cpp, line 163]
nsTreeBoxObject::GetView  [mozilla/layout/xul/base/src/tree/src/nstreeboxobject.cpp, line 194]
nsTreeBodyFrame::EnsureView  [mozilla/layout/xul/base/src/tree/src/nstreebodyframe.cpp, line 388]
nsGenericElement::GetAttrInfo  [mozilla/content/base/src/nsgenericelement.cpp, line 3525]
nsXULElement::FindLocalOrProtoAttr  [mozilla/content/xul/content/src/nsxulelement.h, line 622]

Comment 1

[Martijn Wargers (dead)]

The iframe source consists of this:
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
  <tree style="display: block; position: absolute;">
    <tree style="display: table;">
      <treeseparator style="display: block; position: absolute;">
        <treechildren style="display: block;"/>
      </treeseparator>
      <treechildren style="display: none;"/>
    </tree>
  </tree>
</window>

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Attachment: proposed patch

This patch makes sure that there is one-to-one relation between
nsTreeBodyFrame and nsTreeBoxObject, except in the case where
nsTreeBoxObject hasn't yet updated its mTreeBody. But whenever 
nsTreeBoxObject needs mTreeBody, it is ensured that mTreeBody has
pointer back to boxobject so that raw references can be cleared when
frame is deleted. If the one-to-one connection between these objects 
can't be ensured, nothing really works, but nothing shouldn't crash 
either. In that case it is up to content author to write code which
can be handled as a xul:tree.

nsTreeBoxObject.h is created so that nsTreeBodyFrame can cast 
nsITreeBoxObject to that class. I used the old license block, because 
I just moved the code.

Comment 3

[Martijn Wargers (dead)]

Ok, this patch seems to fix all the issues I was having with trees ;)

Comment 4

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070529 Minefield/3.0a5pre

Comment 5

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/bbbf53ddc9be

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/bbbf53ddc9be