The Tor Browser / file comparison
comparison: layout/xul/tree/crashtests/730441-1.xul
layout/xul/tree/crashtests/730441-1.xul
- branch
- TOR_BUG_3246
- changeset 6
- 8bccb770b82d
equal
deleted
inserted
replaced
| -1:000000000000 | 0:4fc79da88097 |
|---|---|
| 1 <?xml version="1.0"?> | |
| 2 <!-- | |
| 3 Program received signal SIGSEGV, Segmentation fault. | |
| 4 0xb6457185 in nsIContent::SetAttr (this=0x0, aNameSpaceID=0, aName=0xb0cb064c, aValue=..., aNotify=1) at ../../dist/include/nsIContent.h:285 | |
| 5 285 return SetAttr(aNameSpaceID, aName, nsnull, aValue, aNotify); | |
| 6 (gdb) p this | |
| 7 $6 = (nsIContent * const) 0x0 | |
| 8 (gdb) bt 3 | |
| 9 #0 0xb6457185 in nsIContent::SetAttr (this=0x0, aNameSpaceID=0, aName=0xb0cb064c, aValue=..., aNotify=1) at ../../dist/include/nsIContent.h:285 | |
| 10 #1 0xb6b72072 in nsTreeColumns::RestoreNaturalOrder (this=0xaaf83cc0) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:605 | |
| 11 #2 0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69 | |
| 12 (More stack frames follow...) | |
| 13 (gdb) frame 1 | |
| 14 #1 0xb6b72072 in nsTreeColumns::RestoreNaturalOrder (this=0xaaf83cc0) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:605 | |
| 15 605 child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE); | |
| 16 (gdb) list | |
| 17 600 PRUint32 numChildren = colsContent->GetChildCount(); | |
| 18 601 for (PRUint32 i = 0; i < numChildren; ++i) { | |
| 19 602 nsIContent *child = colsContent->GetChildAt(i); | |
| 20 603 nsAutoString ordinal; | |
| 21 604 ordinal.AppendInt(i); | |
| 22 605 child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE); | |
| 23 606 } | |
| 24 (gdb) p child | |
| 25 $7 = (nsIContent *) 0x0 | |
| 26 | |
| 27 First loop iteration: |child->SetAttr()| dispatches "DOMAttrModified" event. | |
| 28 Event listener removes next column. Second loop iteration: |colsContent->GetChildAt(i)| | |
| 29 returns null. Then we have |null->SetAttr()|. | |
| 30 --> | |
| 31 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" | |
| 32 onload="run();"> | |
| 33 <tree id="tree"> | |
| 34 <treecols> | |
| 35 <treecol id="col1"/> | |
| 36 <treecol id="col2"/> | |
| 37 </treecols> | |
| 38 <treechildren/> | |
| 39 </tree> | |
| 40 <script type="text/javascript"><![CDATA[ | |
| 41 function listener() { | |
| 42 var col2 = document.getElementById("col2"); | |
| 43 col2.parentNode.removeChild(col2); | |
| 44 } | |
| 45 | |
| 46 function run() { | |
| 47 var col1 = document.getElementById("col1"); | |
| 48 col1.addEventListener("DOMAttrModified", listener, true); | |
| 49 var tree = document.getElementById("tree"); | |
| 50 tree.columns.restoreNaturalOrder(); | |
| 51 } | |
| 52 ]]></script> | |
| 53 </window> | |
| 54 |
