wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-24 17:37:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo

Browse source
This commit is contained in:
Roy Tam 2018-01-19 03:59:58 +08:00
commit dcd9973243
150858 changed files with 23884658 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
layout/xul/tree/crashtests/307298-1.xul Normal file
View file

@ -0,0 +1,21 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="var tree = document.getElementById('tree'), treeitem = document.getElementById('treeitem'); tree.parentNode.insertBefore(treeitem, tree);">
<tree flex="1" id="tree">
<treecols>
<treecol id="name" label="Name" primary="true" flex="1"/>
</treecols>
<treechildren>
<treeitem id="treeitem">
<treerow>
<treecell label="Click the button below to crash"/>
</treerow>
</treeitem>
</treechildren>
</tree>
</window>

30
layout/xul/tree/crashtests/309732-1.xul Normal file
View file

@ -0,0 +1,30 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
<script>
function boom()
{
document.documentElement.appendChild(document.getElementById("TC"));
document.documentElement.appendChild(document.getElementById("TI"));
document.documentElement.removeAttribute("class");
}
</script>
<tree flex="1">
<treecols>
<treecol label="Name"/>
</treecols>
<treechildren id="TC">
<treeitem id="TI">
<treerow>
<treecell label="First treecell"/>
</treerow>
</treeitem>
</treechildren>
</tree>
</window>

31
layout/xul/tree/crashtests/309732-2.xul Normal file
View file

@ -0,0 +1,31 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
<script>
function boom()
{
document.documentElement.appendChild(document.getElementById('TC'));
document.getElementById('TI').hidden = false;
document.documentElement.removeAttribute("class");
}
</script>
<tree flex="1">
<treecols>
<treecol label="Name" flex="1"/>
</treecols>
<treechildren id="TC">
<treeitem>
<treerow>
<treecell label="First treecell"/>
</treerow>
</treeitem>
</treechildren>
</tree>
<treeitem id="TI" hidden="true"/>
</window>

43
layout/xul/tree/crashtests/366583-1.xul Normal file
View file

@ -0,0 +1,43 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="boom1();"
class="reftest-wait">
<script>
var tree;
function boom1()
{
tree = document.getElementById("tree");
tree.style.position = "fixed";
setTimeout(boom2, 30);
}
function boom2()
{
tree.style.overflow = "visible";
document.documentElement.removeAttribute("class");
}
</script>
<tree rows="6" id="tree" style="display: list-item; overflow: auto; visibility: collapse;">
<treecols>
<treecol id="firstname" label="First Name" primary="true" flex="3"/>
<treecol id="lastname" label="Last Name" flex="7"/>
</treecols>
<treechildren>
<treeitem container="true" open="true">
<treerow>
<treecell label="Foo"/>
</treerow>
</treeitem>
</treechildren>
</tree>
</window>

24
layout/xul/tree/crashtests/380217-1.xul Normal file
View file

@ -0,0 +1,24 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns:html="http://www.w3.org/1999/xhtml"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="document.documentElement.style.content = '\'a\'';">
<html:style>
* { position: fixed; }
</html:style>
<tree rows="6">
<treecols>
<treecol id="firstname" label="First Name" primary="true"/>
</treecols>
<treechildren>
<treeitem>
<treerow>
<treecell/>
</treerow>
</treeitem>
</treechildren>
</tree>
</window>

15
layout/xul/tree/crashtests/382444-1-inner.html Normal file
View file

@ -0,0 +1,15 @@
<html>
<head>
<title>Testcase bug - Crash [@ nsINodeInfo::Equals] with underflow event, tree stuff and removing window</title>
</head>
<body>
<iframe src="data:application/vnd.mozilla.xul+xml;charset=utf-8,%3Cwindow%20xmlns%3D%22http%3A//www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%22%3E%0A%3Ctree%20style%3D%22overflow%3A%20auto%3B%20display%3A%20-moz-inline-box%3B%22%3E%0A%3Ctreeitem%20style%3D%22overflow%3A%20scroll%3B%20display%3A%20table-cell%3B%22%3E%0A%3Ctreechildren%20style%3D%22%20display%3A%20table-row%3B%22%3E%0A%3Ctreeitem%20id%3D%22a%22%20style%3D%22display%3A%20table-cell%3B%22%3E%0A%3C/treeitem%3E%0A%3C/treechildren%3E%0A%3C/treeitem%3E%0A%0A%3C/tree%3E%0A%0A%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3E%0Afunction%20doe%28%29%20%7B%0Adocument.getElementById%28%27a%27%29.parentNode.removeChild%28document.getElementById%28%27a%27%29%29%3B%0A%7D%0AsetTimeout%28doe%2C%20100%29%3B%0Adocument.addEventListener%28%27underflow%27%2C%20function%28e%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%20%7D%2C%20true%29%3B%0Awindow.addEventListener%28%27underflow%27%2C%20function%28e%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%20%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/window%3E" id="content"></iframe>
<script>
function doe() {
window.location.reload();
}
setTimeout(doe, 500);
</script>
</body>
</html>

9
layout/xul/tree/crashtests/382444-1.html Normal file
View file

@ -0,0 +1,9 @@
<html class="reftest-wait">
<head>
<script>
setTimeout('document.documentElement.className = ""', 500);
</script>
<body>
<iframe src="382444-1-inner.html"></iframe>
</body>
</html>

41
layout/xul/tree/crashtests/391178-1.xhtml Normal file
View file

@ -0,0 +1,41 @@
<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
<head>
<script>
var ccc;
function boom()
{
var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
var hbox = document.createElementNS(XUL_NS, 'hbox');
var tree = document.createElementNS(XUL_NS, 'tree');
var treecol = document.createElementNS(XUL_NS, 'treecol');
ccc = document.getElementById("ccc");
ccc.style.position = "fixed";
hbox.appendChild(treecol);
tree.appendChild(hbox);
ccc.appendChild(tree);
setTimeout(boom2, 200);
}
function boom2()
{
ccc.style.position = "";
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="boom();">
<div id="ccc">
</div>
</body>
</html>

20
layout/xul/tree/crashtests/391178-2.xul Normal file
View file

@ -0,0 +1,20 @@
<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" class="reftest-wait">
<tree id="a" style="position: fixed;">
<box style=" display: -moz-box; position: fixed;">
<treecol style=" display: -moz-box;"/>
</box>
<box style="position: fixed;">
<treechildren style="display: -moz-box; position: absolute;"/>
</box>
</tree>
<script xmlns="http://www.w3.org/1999/xhtml">
function removestyles(){
document.getElementById('a').removeAttribute('style');
document.documentElement.removeAttribute("class");
}
setTimeout(removestyles, 100);
</script>
</window>

3
layout/xul/tree/crashtests/393665-1.xul Normal file
View file

@ -0,0 +1,3 @@
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<treechildren style="display: block" />
</window>

44
layout/xul/tree/crashtests/399227-1.xul Normal file
View file

@ -0,0 +1,44 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
<script>
function boom()
{
var tree = document.getElementById("thetree");
var selection = tree.view.selection;
selection.select(0);
tree.parentNode.removeChild(tree);
// This is expected to throw an error (it used to crash).
try {
selection.rangedSelect(1, 1, false);
}
catch (ex) {}
document.documentElement.removeAttribute("class");
}
</script>
<tree flex="1" id="thetree">
<treecols>
<treecol label="Name"/>
</treecols>
<treechildren id="TC">
<treeitem id="TI1">
<treerow>
<treecell label="First treecell"/>
</treerow>
</treeitem>
<treeitem id="TI2">
<treerow>
<treecell label="Second treecell"/>
</treerow>
</treeitem>
</treechildren>
</tree>
</window>

50
layout/xul/tree/crashtests/399227-2.xul Normal file
View file

@ -0,0 +1,50 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30);">
<script>
function boom()
{
var tree = document.getElementById("thetree");
var selection = tree.view.selection;
var treecolumn0 = tree.columns[0];
var treecolumn1 = tree.columns[1];
selection.select(0);
selection.currentColumn = treecolumn0;
tree.parentNode.removeChild(tree);
// This is expected to throw an error (it used to crash).
try {
selection.currentColumn = treecolumn1;
}
catch (ex) {}
document.documentElement.removeAttribute("class");
}
</script>
<tree flex="1" id="thetree" seltype="cell">
<treecols>
<treecol label="Name"/>
<treecol label="Test"/>
</treecols>
<treechildren id="TC">
<treeitem id="TI1">
<treerow>
<treecell label="First treecell"/>
<treecell label="Second treecell"/>
</treerow>
</treeitem>
<treeitem id="TI2">
<treerow>
<treecell label="Third treecell"/>
<treecell label="Fourth treecell"/>
</treerow>
</treeitem>
</treechildren>
</tree>
</window>

10
layout/xul/tree/crashtests/399692-1.xhtml Normal file
View file

@ -0,0 +1,10 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head>
</head>
<body>
<xul:treechildren style="display: inline;" />
</body>
</html>

9
layout/xul/tree/crashtests/399715-1.xhtml Normal file
View file

@ -0,0 +1,9 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<body style="float: right;" onload="document.body.style.cssFloat = '';">
<xul:tree><xul:hbox><xul:treecol /></xul:hbox></xul:tree>
</body>
</html>

25
layout/xul/tree/crashtests/409807-1.xul Normal file
View file

@ -0,0 +1,25 @@
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
<script type="text/javascript">
function boom()
{
var tree = document.getElementById("tree");
var tc = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "treechildren");
document.addEventListener("DOMAttrModified", m, false);
tree.appendChild(tc);
function m()
{
document.removeEventListener("DOMAttrModified", m, false);
tree.removeChild(tc);
}
}
</script>
<tree id="tree" />
</window>

20
layout/xul/tree/crashtests/414170-1.xul Normal file
View file

@ -0,0 +1,20 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="boom();">
<script type="text/javascript">
function boom()
{
var option = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
document.getElementById("tc").appendChild(option);
}
</script>
<tree><treechildren id="tc"><hbox/></treechildren></tree>
</window>

8
layout/xul/tree/crashtests/430394-1.xul Normal file
View file

@ -0,0 +1,8 @@
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<tree id="a" style="content: 't';" rows="-2">
<menuitem id="b" onoverflow="event.currentTarget.parentNode.removeAttribute('style')">
<treechildren style="display: block;" onoverflow="event.target.parentNode.removeChild(event.target)" />
<treechildren style="display: block;" ordinal="0.5"/>
</menuitem>
</tree>
</window>

23
layout/xul/tree/crashtests/454186-1.xul Normal file
View file

@ -0,0 +1,23 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<tree flex="1">
<treecols>
<treecol label="test" flex="1" type="progressmeter" />
</treecols>
<treechildren>
<treeitem>
<treerow>
<treecell value="50" mode="normal" />
</treerow>
</treeitem>
<treeitem>
<treerow>
<treecell mode="undetermined" />
</treerow>
</treeitem>
</treechildren>
</tree>
</window>

19
layout/xul/tree/crashtests/479931-1.xhtml Normal file
View file

@ -0,0 +1,19 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head>
<script type="text/javascript">
function boom()
{
var o = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
var q = document.getElementById("q");
q.appendChild(o);
}
</script>
</head>
<body onload="boom();">
<xul:tree><xul:treechildren id="q"><div/></xul:treechildren></xul:tree>
</body>
</html>

12
layout/xul/tree/crashtests/509602-1-overlay.xul Normal file
View file

@ -0,0 +1,12 @@
<?xml version="1.0" encoding="UTF-8"?>
<overlay xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<box id="b">
<box onDOMAttrModified="event.target.parentNode.removeChild(event.target)" id="d"/>
<tree/>
</box>
<tree>
<box id="b" observes="d"/>
<treechildren observes="b"/>
</tree>
</overlay>

3
layout/xul/tree/crashtests/509602-1.xul Normal file
View file

@ -0,0 +1,3 @@
<?xul-overlay href="509602-1-overlay.xul"?>
<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/>

72
layout/xul/tree/crashtests/585815-iframe.xul Normal file
View file

@ -0,0 +1,72 @@
<?xml version="1.0"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="setInterval(run, 25)">
<tree flex="1" rows="2">
<treecols>
<treecol id="sender" label="Sender" flex="1"/>
<treecol id="subject" label="Subject" flex="2"/>
</treecols>
<treechildren>
<treeitem>
<treerow>
<treecell label="joe@somewhere.com"/>
<treecell label="Top secret plans"/>
</treerow>
</treeitem>
<treeitem>
<treerow>
<treecell label="mel@whereever.com"/>
<treecell label="Let's do lunch"/>
</treerow>
</treeitem>
<treeitem>
<treerow>
<treecell label="mel@whereever.com"/>
<treecell label="Let's do lunch"/>
</treerow>
</treeitem>
<treeitem>
<treerow>
<treecell label="mel@whereever.com"/>
<treecell label="Let's do lunch"/>
</treerow>
</treeitem>
<treeitem>
<treerow>
<treecell label="mel@whereever.com"/>
<treecell label="Let's do lunch"/>
</treerow>
</treeitem>
<treeitem>
<treerow>
<treecell label="mel@whereever.com"/>
<treecell label="Let's do lunch"/>
</treerow>
</treeitem>
<treeitem>
<treerow>
<treecell label="mel@whereever.com"/>
<treecell label="Let's do lunch"/>
</treerow>
</treeitem>
<treeitem>
<treerow>
<treecell label="mel@whereever.com"/>
<treecell label="Let's do lunch"/>
</treerow>
</treeitem>
</treechildren>
</tree>
<script type="text/javascript"><![CDATA[
function run() {
var tree = document.getElementsByTagName("tree")[0];
var sel = tree.view.selection;
sel.rangedSelect(0, 0, true);
sel.rangedSelect(1000, 1001, true);
sel.adjustSelection(1, 0x7fffffff);
}
]]></script>
</window>

18
layout/xul/tree/crashtests/585815.html Normal file
View file

@ -0,0 +1,18 @@
<!DOCTYPE HTML>
<html class="reftest-wait"><head>
<meta charset="utf-8">
<title>Testcase for bug 585815</title>
<script>
function done()
{
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="setTimeout(done,1000)">
<iframe src="585815-iframe.xul"></iframe>
</body>
</html>

30
layout/xul/tree/crashtests/601427.html Normal file
View file

@ -0,0 +1,30 @@
<!DOCTYPE html>
<html class="reftest-wait">
<script>
var onPaintFunctions =
[
function() { document.documentElement.style.MozAppearance = "treeheadersortarrow"; },
function() { document.documentElement.style.position = "fixed"; },
function() { document.documentElement.removeAttribute("class"); }
];
var i = 0;
function advance()
{
var f = onPaintFunctions[i++];
if (f)
f();
}
function start()
{
window.addEventListener("MozAfterPaint", advance, true);
advance();
}
window.addEventListener("load", start, false);
</script>
</html>

54
layout/xul/tree/crashtests/730441-1.xul Normal file
View file

@ -0,0 +1,54 @@
<?xml version="1.0"?>
<!--
Program received signal SIGSEGV, Segmentation fault.
0xb6457185 in nsIContent::SetAttr (this=0x0, aNameSpaceID=0, aName=0xb0cb064c, aValue=..., aNotify=1) at ../../dist/include/nsIContent.h:285
285 return SetAttr(aNameSpaceID, aName, nsnull, aValue, aNotify);
(gdb) p this
$6 = (nsIContent * const) 0x0
(gdb) bt 3
#0 0xb6457185 in nsIContent::SetAttr (this=0x0, aNameSpaceID=0, aName=0xb0cb064c, aValue=..., aNotify=1) at ../../dist/include/nsIContent.h:285
#1 0xb6b72072 in nsTreeColumns::RestoreNaturalOrder (this=0xaaf83cc0) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:605
#2 0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
(More stack frames follow...)
(gdb) frame 1
#1 0xb6b72072 in nsTreeColumns::RestoreNaturalOrder (this=0xaaf83cc0) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:605
605 child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE);
(gdb) list
600 PRUint32 numChildren = colsContent->GetChildCount();
601 for (PRUint32 i = 0; i < numChildren; ++i) {
602 nsIContent *child = colsContent->GetChildAt(i);
603 nsAutoString ordinal;
604 ordinal.AppendInt(i);
605 child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE);
606 }
(gdb) p child
$7 = (nsIContent *) 0x0
First loop iteration: |child->SetAttr()| dispatches "DOMAttrModified" event.
Event listener removes next column. Second loop iteration: |colsContent->GetChildAt(i)|
returns null. Then we have |null->SetAttr()|.
-->
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="run();">
<tree id="tree">
<treecols>
<treecol id="col1"/>
<treecol id="col2"/>
</treecols>
<treechildren/>
</tree>
<script type="text/javascript"><![CDATA[
function listener() {
var col2 = document.getElementById("col2");
col2.parentNode.removeChild(col2);
}
function run() {
var col1 = document.getElementById("col1");
col1.addEventListener("DOMAttrModified", listener, true);
var tree = document.getElementById("tree");
tree.columns.restoreNaturalOrder();
}
]]></script>
</window>

52
layout/xul/tree/crashtests/730441-2.xul Normal file
View file

@ -0,0 +1,52 @@
<?xml version="1.0"?>
<!--
Program received signal SIGSEGV, Segmentation fault.
0xb6b720a6 in nsTreeColumns::RestoreNaturalOrder (this=0xa947a580) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:610
610 mTree->Invalidate();
(gdb) bt 3
#0 0xb6b720a6 in nsTreeColumns::RestoreNaturalOrder (this=0xa947a580) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:610
#1 0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
#2 0xb6171901 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)
at js/src/xpconnect/src/xpcwrappednative.cpp:2722
(More stack frames follow...)
(gdb) list
605 child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE);
606 }
607
608 nsTreeColumns::InvalidateColumns();
609
610 mTree->Invalidate();
611
612 return NS_OK;
613 }
614
(gdb) p mTree
$9 = (nsITreeBoxObject *) 0x0
|child->SetAttr()| dispatches "DOMAttrModified" event. Event listener removes
whole tree, |mTree| is being set to null. Then we have |null->Invalidate()|.
-->
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="run();">
<tree id="tree">
<treecols>
<treecol id="col"/>
</treecols>
<treechildren/>
</tree>
<script type="text/javascript"><![CDATA[
var tree = null;
function listener() {
tree.parentNode.removeChild(tree);
}
function run() {
col = document.getElementById("col");
col.addEventListener("DOMAttrModified", listener, true);
tree = document.getElementById("tree");
tree.columns.restoreNaturalOrder();
}
]]></script>
</window>

38
layout/xul/tree/crashtests/730441-3.xul Normal file
View file

@ -0,0 +1,38 @@
<?xml version="1.0"?>
<!--
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../../../dist/include/nsCOMPtr.h, line 796
Program received signal SIGSEGV, Segmentation fault.
0xb6b7463a in nsTreeContentView::SetTree (this=0xb0ba2510, aTree=0xaaecece0) at layout/xul/base/src/tree/src/nsTreeContentView.cpp:571
571 boxObject->GetElement(getter_AddRefs(element));
(gdb) bt 3
#0 0xb6b7463a in nsTreeContentView::SetTree (this=0xb0ba2510, aTree=0xaaecece0) at layout/xul/base/src/tree/src/nsTreeContentView.cpp:571
#1 0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
#2 0xb6171901 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)
at js/src/xpconnect/src/xpcwrappednative.cpp:2722
(More stack frames follow...)
(gdb) list 566
561 nsTreeContentView::SetTree(nsITreeBoxObject* aTree)
562 {
563 ClearRows();
564
565 mBoxObject = aTree;
566
567 if (aTree && !mRoot) {
568 // Get our root element
569 nsCOMPtr<nsIBoxObject> boxObject = do_QueryInterface(mBoxObject);
570 nsCOMPtr<nsIDOMElement> element;
571 boxObject->GetElement(getter_AddRefs(element));
(gdb) p boxObject
$16 = {mRawPtr = 0x0}
|aTree| does not implement |nsIBoxObject|, so |do_QueryInterface(mBoxObject)|
returns null. Then we have |null->GetElement()|.
-->
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="document.getElementById('tree').view.setTree({});">
<tree id="tree">
<treechildren/>
</tree>
</window>

24
layout/xul/tree/crashtests/crashtests.list Normal file
View file

@ -0,0 +1,24 @@
load 307298-1.xul
load 309732-1.xul
load 309732-2.xul
load 366583-1.xul
load 380217-1.xul
load 382444-1.html
load 391178-1.xhtml
load 391178-2.xul
load 393665-1.xul
load 399227-1.xul
load 399227-2.xul
load 399692-1.xhtml
load 399715-1.xhtml
load 409807-1.xul
load 414170-1.xul
load 430394-1.xul
load 454186-1.xul
load 479931-1.xhtml
load 509602-1.xul
load 585815.html
load 601427.html
load 730441-1.xul
load 730441-2.xul
load 730441-3.xul