The Tor Browser: layout/xul/tree/crashtests/730441-3.xul@7e26c7da4463

     1 <?xml version="1.0"?>

     2 <!--

     3 ###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../../../dist/include/nsCOMPtr.h, line 796

     5 Program received signal SIGSEGV, Segmentation fault.

     6 0xb6b7463a in nsTreeContentView::SetTree (this=0xb0ba2510, aTree=0xaaecece0) at layout/xul/base/src/tree/src/nsTreeContentView.cpp:571

     7 571        boxObject->GetElement(getter_AddRefs(element));

     8 (gdb) bt 3

     9 #0  0xb6b7463a in nsTreeContentView::SetTree (this=0xb0ba2510, aTree=0xaaecece0) at layout/xul/base/src/tree/src/nsTreeContentView.cpp:571

    10 #1  0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69

    11 #2  0xb6171901 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)

    12     at js/src/xpconnect/src/xpcwrappednative.cpp:2722

    13 (More stack frames follow...)

    14 (gdb) list 566

    15 561    nsTreeContentView::SetTree(nsITreeBoxObject* aTree)

    16 562    {

    17 563      ClearRows();

    18 564

    19 565      mBoxObject = aTree;

    20 566

    21 567      if (aTree && !mRoot) {

    22 568        // Get our root element

    23 569        nsCOMPtr<nsIBoxObject> boxObject = do_QueryInterface(mBoxObject);

    24 570        nsCOMPtr<nsIDOMElement> element;

    25 571        boxObject->GetElement(getter_AddRefs(element));

    26 (gdb) p boxObject

    27 $16 = {mRawPtr = 0x0}

    29 |aTree| does not implement |nsIBoxObject|, so |do_QueryInterface(mBoxObject)|

    30 returns null. Then we have |null->GetElement()|.

    31 -->

    32 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"

    33         onload="document.getElementById('tree').view.setTree({});">

    34 <tree id="tree">

    35   <treechildren/>

    36 </tree>

    37 </window>

The Tor Browser / file revision