89833 - XUL in XBL crashes mozilla

Status: RESOLVED WORKSFORME

(Core :: XBL, defect)

Description

[John Ky]

From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 
1.0.2914)
BuildID:    2001062815

Adding <xul:treechildren/> to XBL causes mozilla to crash.

Reproducible: Always
Steps to Reproduce:
Save the attacked *.zip file.  Extract three 
files "treetest.xul", "tree.xml", "mozilla.css" to a directory and 
open "treetest.xul" in mozilla.



Actual Results:  Mozilla crashed.

Expected Results:  Mozilla should not crash.

Comment 1

[John Ky]

Attachment: demo of crash bug - please unzip and open treetest.xul

Comment 2

[mwehner]

Confirmed on Linux Build 2001070608

Comment 3

[Håkan Waara]

I debugged some, and this is the logic of my upcoming fix:

When the tree initializes itself, it checks how many rows it currently contains
annd its rows' properties. If there are no rows, or tree children (or whatever,
I'm not sure :) ) then it will crash because a frame is null.

My fix is to set return 0 as the initial rowcount for this state and return a
special return value (-1) for the function that checks the height of something
which makes the caller understand that the height is bogus.

When I compiled this and tried again, the XUL rendered nicely.  I'm not sure I
understand the fix but it seems that it fixed the root cause of this bug!

Comment 4

[Håkan Waara]

Attachment: fix

Comment 5

[Håkan Waara]

Hyatt, do you think you can review this little crash fix?

Comment 6

[David Hyatt]

This isn't really the right fix.  The GetTreeParent function should never 
return null, so you shouldn't be having to add this code.

Comment 7

[Alex Fritze]

This is a duplicate of bug #68936, I think. The patch attached there fixes 
GetTreeParent().

Comment 8

[Markus Multrus]

this works for me now (at least, it doesn't crash...), Mozilla/5.0 (X11; U;
Linux i686; en-US; rv:1.2a) Gecko/20020910, pulled from cvs,  build myself
Could someone else have a look at it?

Comment 9

[John Morrison]

Thanks. Doesn't crash for me. All the old tree code was (mostly) replaced
a few months ago.