460461 - Crash [@ ~UndisplayedNode() ] deleting mNext pointer of same type.

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Mats Palmgren (inactive)]

Same problem as in bug 456196 and bug 460444.

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/base/nsFrameManager.cpp&rev=1.259&root=/cvsroot&mark=204#191

Comment 1

[Mats Palmgren (inactive)]

Attachment: Testcase (zipped because it was too big)

Comment 2

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

This is just an inlined version of NS_CSS_DELETE_LIST_MEMBER.
Perhaps we should move that macro somewhere else so we can reuse it
in more places?  (I think we're going to need it in bug 460444 too.)

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 343555 [details] [diff] [review]
Patch rev. 1

>+    mNext = nsnull;

This line isn't really necessary, although I suppose it doesn't hurt.

r+sr=dbaron

Comment 4

[Mats Palmgren (inactive)]

> This line isn't really necessary

True, I removed it.

http://hg.mozilla.org/mozilla-central/rev/1b2dab16f5ab

I couldn't figure out a crash test that wouldn't take minutes to load,
so no test, sorry.

-> FIXED

Comment 5

[Marcia Knous [:marcia]]

verified fixed using : Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b2pre) Gecko/20081118 Minefield/3.1b2pre and Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b2pre) Gecko/20081118 Minefield/3.1b2pre. The testcase does not crash for me.

Comment 6

[Daniel Veditz [:dveditz]]

Do we want this on 1.9.0.x?