Closed Bug 381862 Opened 13 years ago Closed 13 years ago

Crash [@ nsBoxFrame::BuildDisplayListForChildren] with tree stuff in iframe toggling display

Categories

(Core :: XUL, defect, critical)

x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: smaug)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

Attached file testcase
See testcase, which crashes current trunk Mozilla builds.
This seems to have regressed between 2007-04-26 and 2007-04-27:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-04-26+04&maxdate=2007-04-27+09&cvsroot=%2Fcvsroot
Although that might be nonsense, because I think I have cases where it crashes earlier.

Talkback ID: TB32466691W
nsBoxFrame::BuildDisplayListForChildren  [mozilla/layout/xul/base/src/nsboxframe.cpp, line 1266]
nsTreeColFrame::BuildDisplayListForChildren  [mozilla/layout/xul/base/src/tree/src/nstreecolframe.cpp, line 163]
nsTreeBoxObject::GetView  [mozilla/layout/xul/base/src/tree/src/nstreeboxobject.cpp, line 194]
nsTreeBodyFrame::EnsureView  [mozilla/layout/xul/base/src/tree/src/nstreebodyframe.cpp, line 388]
nsGenericElement::GetAttrInfo  [mozilla/content/base/src/nsgenericelement.cpp, line 3525]
nsXULElement::FindLocalOrProtoAttr  [mozilla/content/xul/content/src/nsxulelement.h, line 622]
The iframe source consists of this:
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
  <tree style="display: block; position: absolute;">
    <tree style="display: table;">
      <treeseparator style="display: block; position: absolute;">
        <treechildren style="display: block;"/>
      </treeseparator>
      <treechildren style="display: none;"/>
    </tree>
  </tree>
</window>
Assignee: Jan.Varga → Olli.Pettay
Blocks: 381502
Attached patch proposed patchSplinter Review
This patch makes sure that there is one-to-one relation between
nsTreeBodyFrame and nsTreeBoxObject, except in the case where
nsTreeBoxObject hasn't yet updated its mTreeBody. But whenever 
nsTreeBoxObject needs mTreeBody, it is ensured that mTreeBody has
pointer back to boxobject so that raw references can be cleared when
frame is deleted. If the one-to-one connection between these objects 
can't be ensured, nothing really works, but nothing shouldn't crash 
either. In that case it is up to content author to write code which
can be handled as a xul:tree.

nsTreeBoxObject.h is created so that nsTreeBodyFrame can cast 
nsITreeBoxObject to that class. I used the old license block, because 
I just moved the code.
Attachment #265959 - Flags: superreview?(roc)
Attachment #265959 - Flags: review?(roc)
Ok, this patch seems to fix all the issues I was having with trees ;)
Attachment #265959 - Flags: superreview?(roc)
Attachment #265959 - Flags: superreview+
Attachment #265959 - Flags: review?(roc)
Attachment #265959 - Flags: review+
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070529 Minefield/3.0a5pre
Status: RESOLVED → VERIFIED
Flags: in-testsuite?
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: xptoolkit.trees → xptoolkit.widgets
Crash Signature: [@ nsBoxFrame::BuildDisplayListForChildren]
Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/bbbf53ddc9be
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.