Last Comment Bug 535361 - Document viewer child traversal can traverse random viewers that aren't its kids
: Document viewer child traversal can traverse random viewers that aren't its kids
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: DOM (show other bugs)
: Trunk
: x86 Mac OS X
: -- normal (vote)
: ---
Assigned To: Boris Zbarsky [:bz] (still a bit busy)
:
:
Mentors:
Depends on:
Blocks: 500882
  Show dependency treegraph
 
Reported: 2009-12-16 13:02 PST by Boris Zbarsky [:bz] (still a bit busy)
Modified: 2009-12-23 13:19 PST (History)
2 users (show)
bzbarsky: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Proposed fix (3.18 KB, patch)
2009-12-16 21:14 PST, Boris Zbarsky [:bz] (still a bit busy)
jst: review+
Details | Diff | Splinter Review

Description Boris Zbarsky [:bz] (still a bit busy) 2009-12-16 13:02:43 PST
In particular, this callstack:

#8  0x0349fa4c in DocumentViewerImpl::CallChildren (this=0x2472de70, aFunc=0x349d7d8 <SetChildFullZoom(nsIMarkupDocumentViewer*, void*)>, aClosure=0xbfffc774) at /Users/bzbarsky/mozilla/vanilla/mozilla/layout/base/nsDocumentViewer.cpp:2816
#9  0x034a59df in DocumentViewerImpl::SetFullZoom (this=0x2472de70, aFullZoom=1) at /Users/bzbarsky/mozilla/vanilla/mozilla/layout/base/nsDocumentViewer.cpp:2956
#10 0x03ebf58d in nsDocShell::SetupNewViewer (this=0x7c49030, aNewViewer=0x2472de70) at /Users/bzbarsky/mozilla/vanilla/mozilla/docshell/base/nsDocShell.cpp:7343

causes us to get kids off the docshell, but since the docshell hasn't dropped its old kids yet we end up traversing kids that don't actually belong to us.  This triggers assertions in nsDocShell::GetVisibility in the kids, since we can't find the content node in the parent (the new viewer!) that contains the kid.
Comment 1 Boris Zbarsky [:bz] (still a bit busy) 2009-12-16 21:14:08 PST
Created attachment 418100 [details] [diff] [review]
Proposed fix
Comment 2 Boris Zbarsky [:bz] (still a bit busy) 2009-12-23 13:19:03 PST
Pushed http://hg.mozilla.org/mozilla-central/rev/9298544dd5a9

This will be in-testsuite once bug 500882 lands, effectively.

Note You need to log in before you can comment on or make changes to this bug.