468360 - tree without treecols definition crashes the browser in [@XULTreeAccessible::TreeViewInvalidated]

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Tobias (:Tobbi) Markus]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4
Build Identifier: 

I found out that when you execute a XUL file with a tree in it but no tree definition the browser crashes. 

Crash report associated with this issue can be found here: 
http://crash-stats.mozilla.com/report/pending/14bc2de6-28d6-4c8c-8d48-1d9c22081207

Test cases can be found here: http://tobbi.bplaced.net/testcases/testcase2.xul (XUL) and here http://tobbi.bplaced.net/testcases/testcase2.txt (TXT)



Reproducible: Always

Steps to Reproduce:
1.Open XUL file with tree definition but without definition of <treerows> element.
2.Firefox crashes in [@XULTreeAccessible::TreeViewInvalidated]
Actual Results:  
Crash [@XULTreeAccessible::TreeViewInvalidated]

Comment 1

[Tobias (:Tobbi) Markus]

Attachment: Testcase for this bug as XUL

Comment 2

[Tobias (:Tobbi) Markus]

Attachment: Testcase for this bug as TXT

Comment 3

[Tobias (:Tobbi) Markus]

Tests on two different OSes (XP and Vista) assume that this only crashes on Win Vista. Can someone confirm this please?

Comment 4

[Justin Wood (:Callek)]

Verified that it does NOT crash on WinXP... (recent shiretoko)

Comment 5

[Justin Wood (:Callek)]

(In reply to comment #4)
> Verified that it does NOT crash on WinXP... (recent shiretoko)

Erm cancel -- No accessibility enabled, so my test is irrelevant

Comment 6

[Tobias (:Tobbi) Markus]

Confirmed with Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)

Comment 7

[Kevin Brosnan]

works for me in Windows 7 and Linux no crashes in

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4


Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b5pre) Gecko/20090509 Shiretoko/3.5b5pre

Comment 8

[Matthew Middleton (:zzxc)]

I was able to reproduce the crash with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 after creating a new profile and restarting.

Crash ID: bp-7e1f0dee-b7b1-42d9-9c5f-b47a42090510

Comment 9

[timeless]

surkov.alexander 1.75 
  651 mTree->GetColumns(getter_AddRefs(treeColumns));
  652 NS_ENSURE_STATE(treeColumns);
  663 nsCOMPtr<nsITreeColumn> col;
  664 rv = treeColumns->GetKeyColumn(getter_AddRefs(col));
  665 NS_ENSURE_SUCCESS(rv, rv);
  666
  667 PRInt32 colIdx = 0;
  668 rv = col->GetIndex(&colIdx);

alexander: we're crashing because col is null

http://mxr.mozilla.org/mozilla-central/source/layout/xul/base/src/tree/src/nsTreeColumns.cpp#475
475 nsTreeColumns::GetKeyColumn(nsITreeColumn** _retval)
478   *_retval = nsnull;
517   NS_IF_ADDREF(*_retval);
518   return NS_OK;

GetKeyColumn doesn't throw exceptions for null values.

Comment 10

[Samuel Sidler (old account; do not CC)]

Pushing out this nomination to 1.9.0.12. We'll consider it, but doubt we'll block as it doesn't seem common and is not a regression.

Comment 11

[timeless]

Attachment: this should fix it

Comment 12

[alexander :surkov (:asurkov)]

Comment on attachment 376777 [details] [diff] [review]
this should fix it

timeless, thank you for the patch, I think it make sense to put your null check in nsXULTreeAccessible::InvalidateCach since it has similar logic.

Comment 13

[alexander :surkov (:asurkov)]

checked in, http://hg.mozilla.org/mozilla-central/rev/4df6d6006daf

Comment 14

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 376777 [details] [diff] [review]
this should fix it

a191=beltzner

Comment 15

[Dão Gottwald [:dao]]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/668c499d2986

Comment 16

[Daniel Veditz [:dveditz]]

Comment on attachment 376777 [details] [diff] [review]
this should fix it

We'd rather approve what actually got checked in and tested on the trunk and 1.9.1 branches.

Comment 17

[Tobias (:Tobbi) Markus]

VERIFIED FIXED with
Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)