Last Comment Bug 535361 - Document viewer child traversal can traverse random viewers that aren't its kids
: Document viewer child traversal can traverse random viewers that aren't its kids
Product: Core
Classification: Components
Component: DOM (show other bugs)
: Trunk
: x86 Mac OS X
: -- normal (vote)
: ---
Assigned To: Boris Zbarsky [:bz]
Depends on:
Blocks: 500882
  Show dependency treegraph
Reported: 2009-12-16 13:02 PST by Boris Zbarsky [:bz]
Modified: 2009-12-23 13:19 PST (History)
2 users (show)
bzbarsky: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Proposed fix (3.18 KB, patch)
2009-12-16 21:14 PST, Boris Zbarsky [:bz]
jst: review+
Details | Diff | Splinter Review

Description Boris Zbarsky [:bz] 2009-12-16 13:02:43 PST
In particular, this callstack:

#8  0x0349fa4c in DocumentViewerImpl::CallChildren (this=0x2472de70, aFunc=0x349d7d8 <SetChildFullZoom(nsIMarkupDocumentViewer*, void*)>, aClosure=0xbfffc774) at /Users/bzbarsky/mozilla/vanilla/mozilla/layout/base/nsDocumentViewer.cpp:2816
#9  0x034a59df in DocumentViewerImpl::SetFullZoom (this=0x2472de70, aFullZoom=1) at /Users/bzbarsky/mozilla/vanilla/mozilla/layout/base/nsDocumentViewer.cpp:2956
#10 0x03ebf58d in nsDocShell::SetupNewViewer (this=0x7c49030, aNewViewer=0x2472de70) at /Users/bzbarsky/mozilla/vanilla/mozilla/docshell/base/nsDocShell.cpp:7343

causes us to get kids off the docshell, but since the docshell hasn't dropped its old kids yet we end up traversing kids that don't actually belong to us.  This triggers assertions in nsDocShell::GetVisibility in the kids, since we can't find the content node in the parent (the new viewer!) that contains the kid.
Comment 1 Boris Zbarsky [:bz] 2009-12-16 21:14:08 PST
Created attachment 418100 [details] [diff] [review]
Proposed fix
Comment 2 Boris Zbarsky [:bz] 2009-12-23 13:19:03 PST

This will be in-testsuite once bug 500882 lands, effectively.

Note You need to log in before you can comment on or make changes to this bug.