Closed
Bug 441994
Opened 16 years ago
Closed 16 years ago
Toolbar Customize... context menu entry crashes in [@ nsContentUtils::ComparePosition]
Categories
(Core :: Layout, defect)
Tracking
()
RESOLVED
FIXED
mozilla1.9.1a1
People
(Reporter: MatsPalmgren_bugz, Unassigned)
References
Details
(Keywords: crash, regression)
Crash Data
Attachments
(3 files)
|
(deleted),
text/plain
|
Details | |
|
(deleted),
text/plain
|
Details | |
|
(deleted),
patch
|
roc
:
review+
roc
:
superreview+
|
Details | Diff | Splinter Review |
Toolbar Customize... context menu entry crashes in
[@ nsContentUtils::ComparePosition]. Tracing shows that there's
a destroyed content node in mIdContentList.
Maybe a regression from bug 344258?
STEPS TO REPRODUCE
1. start Firefox
2. right-click on the navigation toolbar
3. select Customize... from the context menu
ACTUAL RESULTS
crash
Firefox 2008062402 nightly on Linux and also in local debug build.
|
Reporter | |
Comment 1•16 years ago
|
||
|
|
Reporter | |
Comment 2•16 years ago
|
||
FWIW, the destroyed content node is a:
<XUL* xul:hbox@0x1203410 intrinsicstate=[00008000] refcount=1<>
|
|
Reporter | |
Comment 3•16 years ago
|
||
|
|
Reporter | |
Updated•16 years ago
|
Attachment #326875 -
Attachment description: stack → crash stack
|
|
Reporter | |
Comment 4•16 years ago
|
||
FWIW, the id for the offending node is "autocomplete-security-wrapper".
There is a call to UpdateIdTableEntry() for it just after it has
been created, there are no calls to nsDocument::RemoveFromIdTable for
it before it's Release'd.
|
||
Comment 5•16 years ago
|
||
Related to bug 441607?
|
|
Reporter | |
Comment 6•16 years ago
|
||
Bug 344258 added a UpdateIdTableEntry(aElement) in AddElementToDocumentPre(),
this is to undo that when the element is removed.
Seems to fix bug 441607 too.
Attachment #326969 -
Flags: superreview?(roc)
Attachment #326969 -
Flags: review?(roc)
Comment on attachment 326969 [details] [diff] [review]
Like so?
Can you write a crashtest for this, if it's not too hard?
Attachment #326969 -
Flags: superreview?(roc)
Attachment #326969 -
Flags: superreview+
Attachment #326969 -
Flags: review?(roc)
Attachment #326969 -
Flags: review+
|
|
Reporter | |
Comment 8•16 years ago
|
||
I tried to write a crashtest, unfortunately I wasn't able to.
http://hg.mozilla.org//mozilla-central/index.cgi/rev/352ccf413e87
-> FIXED
Status: NEW → RESOLVED
Closed: 16 years ago
Flags: blocking1.9.1? → in-testsuite?
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.1a1
|
Assignee | |
Updated•13 years ago
|
Crash Signature: [@ nsContentUtils::ComparePosition]
You need to log in
before you can comment on or make changes to this bug.
Description
•