Closed Bug 393321 Opened 17 years ago Closed 16 years ago

trees set attributes during reflow (nsTreeBodyFrame::UpdateScrollbars) still crashes Mac 2.0.0.6

Categories

(Core :: XUL, defect)

Product:
Core
Component:
XUL
Version:
1.8 Branch
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: abillings, Assigned: smaug)

References

Details

(Keywords: verified1.8.1.19, Whiteboard: [sg:critical] bug 381120 still crashes in 1.8.1.x on Mac)

Attachments

(3 files)

Testcase, crashes on load
5.24 KB, application/vnd.mozilla.xul+xml
Details
Crash report from 2.0.0.17 on OS X 10.5
30.19 KB, text/plain
Details
keep the content object alive while setting attribute
1.10 KB, patch
roc
: review+
roc
: superreview+
dveditz
: approval1.8.1.19+
asac
: approval1.8.0.next+
Details | Diff | Splinter Review 
This is originally from Bug 381120. This was fixed for most instances but still crashes 2.0.0.6 for the Mac.

I'm opening a new bug after talking to Dveditz since it may not be the same issue (there is no functioning talkback on Mac 2.0.0.6). 

The test case is the second testcase from the original bug, added here.
Assignee: nobody → Jan.Varga
Component: General → XP Toolkit/Widgets: Trees
Product: Firefox → Core
QA Contact: general → xptoolkit.trees
Version: unspecified → 1.8 Branch
Assignee: Jan.Varga → Olli.Pettay
Blocks: 381120
Group: security
Flags: wanted1.8.1.x+
Whiteboard: bug 381120 still crashes in 1.8.1.x on Mac
Doesn't crash in Linux and that is the only dev.machine I have :(
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: xptoolkit.trees → xptoolkit.widgets
Repro's in 2.0.0.17 on OS X only.  Marking sg:critical due to SIGSEV at random looking address.
Whiteboard: bug 381120 still crashes in 1.8.1.x on Mac → [sg:critical] bug 381120 still crashes in 1.8.1.x on Mac
(In reply to comment #1)
> Doesn't crash in Linux and that is the only dev.machine I have :(
Just bought a mac. (Terrible for development because of its insane Finnish
keyboard layout and other problems). Will try to reproduce this and hopefully
write a patch.
(In reply to comment #5)
> keep the content object alive while setting attribute
Note, this is what trunk/1.9 does.
Attachment #345084 - Flags: superreview?(roc)
Attachment #345084 - Flags: superreview+
Attachment #345084 - Flags: review?(roc)
Attachment #345084 - Flags: review+
Attachment #345084 - Flags: approval1.8.1.19?
Comment on attachment 345084 [details] [diff] [review]
keep the content object alive while setting attribute

approved for 1.8.1.19, a=dveditz for release-drivers

(please wait for the tree to open before landing)
Attachment #345084 - Flags: approval1.8.1.19? → approval1.8.1.19+
Status: NEW → RESOLVED
Closed: 16 years ago
Keywords: fixed1.8.1.19
Resolution: --- → FIXED
Verified fixed in Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.19pre) Gecko/2008112503 BonEcho/2.0.0.19pre. Crashes cleanly in 1.8.1.18.
Status: RESOLVED → VERIFIED
Keywords: fixed1.8.1.19 → verified1.8.1.19
Comment on attachment 345084 [details] [diff] [review]
keep the content object alive while setting attribute

a=asac for 1.8.0 branch
Attachment #345084 - Flags: approval1.8.0.next+
Flags: blocking1.8.0.next+
Group: core-security
Flags: wanted1.9.0.x-
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: