The Tor Browser: layout/xul/tree/crashtests/730441-2.xul@ca08bd8f51b2

     1 <?xml version="1.0"?>

     2 <!--

     3 Program received signal SIGSEGV, Segmentation fault.

     4 0xb6b720a6 in nsTreeColumns::RestoreNaturalOrder (this=0xa947a580) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:610

     5 610	  mTree->Invalidate();

     6 (gdb) bt 3

     7 #0  0xb6b720a6 in nsTreeColumns::RestoreNaturalOrder (this=0xa947a580) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:610

     8 #1  0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69

     9 #2  0xb6171901 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)

    10     at js/src/xpconnect/src/xpcwrappednative.cpp:2722

    11 (More stack frames follow...)

    12 (gdb) list

    13 605	    child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE);

    14 606	  }

    15 607

    16 608	  nsTreeColumns::InvalidateColumns();

    17 609

    18 610	  mTree->Invalidate();

    19 611

    20 612	  return NS_OK;

    21 613	}

    22 614

    23 (gdb) p mTree

    24 $9 = (nsITreeBoxObject *) 0x0

    26 |child->SetAttr()| dispatches "DOMAttrModified" event. Event listener removes

    27 whole tree, |mTree| is being set to null. Then we have |null->Invalidate()|.

    28 -->

    29 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"

    30         onload="run();">

    31 <tree id="tree">

    32   <treecols>

    33     <treecol id="col"/>

    34   </treecols>

    35   <treechildren/>

    36 </tree>

    37 <script type="text/javascript"><![CDATA[

    38 var tree = null;

    40 function listener() {

    41   tree.parentNode.removeChild(tree);

    42 }

    44 function run() {

    45   col = document.getElementById("col");

    46   col.addEventListener("DOMAttrModified", listener, true);

    47   tree = document.getElementById("tree");

    48   tree.columns.restoreNaturalOrder();

    49 }

    50 ]]></script>

    51 </window>

The Tor Browser / file revision