Closed Bug 374103 Opened 18 years ago Closed 18 years ago

Crash [@ nsTreeBodyFrame::SetView] on branch with testcase from bug 374102

Categories

(Core :: XUL, defect)

Product:
Core
Component:
XUL
Version:
1.8 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 140218

People

(Reporter: martijn.martijn, Assigned: Gavin)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file, 1 obsolete file)

patch
(deleted), patch
Details | Diff | Splinter Review
The testcase from bug 374102 crashes 1.8 builds directly. Talkback ID: TB30268264W nsTreeBodyFrame::SetView [mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 532] nsTreeBodyFrame::EnsureView [mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 421] nsTreeBodyFrame::GetMinSize [mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 220] nsBox::GetPrefSize [mozilla/layout/xul/base/src/nsBox.cpp, line 703] nsBox::GetAscent [mozilla/layout/xul/base/src/nsBox.cpp, line 781] nsStackLayout::GetAscent [mozilla/layout/xul/base/src/nsStackLayout.cpp, line 181] nsBoxFrame::GetAscent [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 987] nsSprocketLayout::GetAscent [mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1591] nsBoxFrame::GetAscent [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 987] nsSprocketLayout::Layout [mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 260] nsBoxFrame::DoLayout [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106] nsBoxFrame::DoLayout [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106] nsRootBoxFrame::Reflow [mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 227] nsContainerFrame::ReflowChild [mozilla/layout/generic/nsContainerFrame.cpp, line 905] ViewportFrame::Reflow [mozilla/layout/generic/nsViewportFrame.cpp, line 240] PresShell::InitialReflow [mozilla/layout/base/nsPresShell.cpp, line 2907] nsXULDocument::StartLayout [mozilla/content/xul/document/src/nsXULDocument.cpp, line 2283] nsXULDocument::ResumeWalk [mozilla/content/xul/document/src/nsXULDocument.cpp, line 3363] nsXULDocument::EndLoad [mozilla/content/xul/document/src/nsXULDocument.cpp, line 739] XULContentSinkImpl::DidBuildModel [mozilla/content/xul/document/src/nsXULContentSink.cpp, line 408] nsExpatDriver::DidBuildModel [mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 1227]
Whiteboard: [sg:nse] reveals bug 374102
Attached patch patch (obsolete) (deleted) — — Splinter Review
With this patch (which I think is correct, given the other callers of GetBaseElement()), the testcase now triggers bug 140218.
Attached patch patch (deleted) — — Splinter Review
(this is the actual patch, oops)
Attachment #259444 - Attachment is obsolete: true
Whiteboard: [sg:nse] reveals bug 374102 → [sg:nse] testcase is in bug 374102
-> Gavin since he's done some work on this
Assignee: Jan.Varga → gavin.sharp
Actually, I didn't notice the first patch in bug 140218, it's the same one I attached here. I've posted a rollup branch patch to that bug.
URL: https://bugzilla.mozilla.org/attachme...
Group: security
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → DUPLICATE
Whiteboard: [sg:nse] testcase is in bug 374102
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: xptoolkit.trees → xptoolkit.widgets
Crash Signature: [@ nsTreeBodyFrame::SetView]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: