The Tor Browser / file comparison
comparison: layout/xul/tree/crashtests/730441-2.xul
layout/xul/tree/crashtests/730441-2.xul
- branch
- TOR_BUG_3246
- changeset 6
- 8bccb770b82d
equal
deleted
inserted
replaced
| -1:000000000000 | 0:87b972df4994 |
|---|---|
| 1 <?xml version="1.0"?> | |
| 2 <!-- | |
| 3 Program received signal SIGSEGV, Segmentation fault. | |
| 4 0xb6b720a6 in nsTreeColumns::RestoreNaturalOrder (this=0xa947a580) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:610 | |
| 5 610 mTree->Invalidate(); | |
| 6 (gdb) bt 3 | |
| 7 #0 0xb6b720a6 in nsTreeColumns::RestoreNaturalOrder (this=0xa947a580) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:610 | |
| 8 #1 0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69 | |
| 9 #2 0xb6171901 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD) | |
| 10 at js/src/xpconnect/src/xpcwrappednative.cpp:2722 | |
| 11 (More stack frames follow...) | |
| 12 (gdb) list | |
| 13 605 child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE); | |
| 14 606 } | |
| 15 607 | |
| 16 608 nsTreeColumns::InvalidateColumns(); | |
| 17 609 | |
| 18 610 mTree->Invalidate(); | |
| 19 611 | |
| 20 612 return NS_OK; | |
| 21 613 } | |
| 22 614 | |
| 23 (gdb) p mTree | |
| 24 $9 = (nsITreeBoxObject *) 0x0 | |
| 25 | |
| 26 |child->SetAttr()| dispatches "DOMAttrModified" event. Event listener removes | |
| 27 whole tree, |mTree| is being set to null. Then we have |null->Invalidate()|. | |
| 28 --> | |
| 29 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" | |
| 30 onload="run();"> | |
| 31 <tree id="tree"> | |
| 32 <treecols> | |
| 33 <treecol id="col"/> | |
| 34 </treecols> | |
| 35 <treechildren/> | |
| 36 </tree> | |
| 37 <script type="text/javascript"><![CDATA[ | |
| 38 var tree = null; | |
| 39 | |
| 40 function listener() { | |
| 41 tree.parentNode.removeChild(tree); | |
| 42 } | |
| 43 | |
| 44 function run() { | |
| 45 col = document.getElementById("col"); | |
| 46 col.addEventListener("DOMAttrModified", listener, true); | |
| 47 tree = document.getElementById("tree"); | |
| 48 tree.columns.restoreNaturalOrder(); | |
| 49 } | |
| 50 ]]></script> | |
| 51 </window> | |
| 52 |
