1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/layout/xul/tree/crashtests/730441-2.xul Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,52 @@
1.4 +<?xml version="1.0"?>
1.5 +<!--
1.6 +Program received signal SIGSEGV, Segmentation fault.
1.7 +0xb6b720a6 in nsTreeColumns::RestoreNaturalOrder (this=0xa947a580) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:610
1.8 +610 mTree->Invalidate();
1.9 +(gdb) bt 3
1.10 +#0 0xb6b720a6 in nsTreeColumns::RestoreNaturalOrder (this=0xa947a580) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:610
1.11 +#1 0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
1.12 +#2 0xb6171901 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)
1.13 + at js/src/xpconnect/src/xpcwrappednative.cpp:2722
1.14 +(More stack frames follow...)
1.15 +(gdb) list
1.16 +605 child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE);
1.17 +606 }
1.18 +607
1.19 +608 nsTreeColumns::InvalidateColumns();
1.20 +609
1.21 +610 mTree->Invalidate();
1.22 +611
1.23 +612 return NS_OK;
1.24 +613 }
1.25 +614
1.26 +(gdb) p mTree
1.27 +$9 = (nsITreeBoxObject *) 0x0
1.28 +
1.29 +|child->SetAttr()| dispatches "DOMAttrModified" event. Event listener removes
1.30 +whole tree, |mTree| is being set to null. Then we have |null->Invalidate()|.
1.31 +-->
1.32 +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
1.33 + onload="run();">
1.34 +<tree id="tree">
1.35 + <treecols>
1.36 + <treecol id="col"/>
1.37 + </treecols>
1.38 + <treechildren/>
1.39 +</tree>
1.40 +<script type="text/javascript"><![CDATA[
1.41 +var tree = null;
1.42 +
1.43 +function listener() {
1.44 + tree.parentNode.removeChild(tree);
1.45 +}
1.46 +
1.47 +function run() {
1.48 + col = document.getElementById("col");
1.49 + col.addEventListener("DOMAttrModified", listener, true);
1.50 + tree = document.getElementById("tree");
1.51 + tree.columns.restoreNaturalOrder();
1.52 +}
1.53 +]]></script>
1.54 +</window>
1.55 +
