From fb47271d472a18a85b917ba05cbbfb3f5bdf4e4c Mon Sep 17 00:00:00 2001
From: Mark Banner <bugzilla@standard8.plus.com>
Date: Mon, 22 Dec 2008 15:32:19 +0000
Subject: [PATCH] Bug 399227 Crash @ nsTreeSelection::GetSingle, null mTree.
 r=enndeakin,sr=Neil

---
 .../base/src/tree/src/crashtests/399227-1.xul | 37 ++++++++++++++++
 .../base/src/tree/src/crashtests/399227-2.xul | 43 +++++++++++++++++++
 .../src/tree/src/crashtests/crashtests.list   |  2 +
 .../xul/base/src/tree/src/nsTreeSelection.cpp | 22 +++++++---
 4 files changed, 99 insertions(+), 5 deletions(-)
 create mode 100644 layout/xul/base/src/tree/src/crashtests/399227-1.xul
 create mode 100644 layout/xul/base/src/tree/src/crashtests/399227-2.xul

diff --git a/layout/xul/base/src/tree/src/crashtests/399227-1.xul b/layout/xul/base/src/tree/src/crashtests/399227-1.xul
new file mode 100644
index 00000000000..cafeb815f85
--- /dev/null
+++ b/layout/xul/base/src/tree/src/crashtests/399227-1.xul
@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
+
+
+  <script>
+  function boom()
+  {
+    var tree = document.getElementById("thetree");
+    var selection = tree.view.selection;
+
+    selection.select(0);
+    tree.parentNode.removeChild(tree);
+    selection.rangedSelect(1, 1, false);
+  }
+  </script>
+
+<tree flex="1" id="thetree">
+    <treecols>
+      <treecol label="Name"/>
+    </treecols>
+    <treechildren id="TC">
+      <treeitem id="TI1">
+        <treerow>
+          <treecell label="First treecell"/>
+        </treerow>
+      </treeitem>
+      <treeitem id="TI2">
+        <treerow>
+          <treecell label="Second treecell"/>
+        </treerow>
+      </treeitem>
+    </treechildren>
+  </tree>
+</window>
diff --git a/layout/xul/base/src/tree/src/crashtests/399227-2.xul b/layout/xul/base/src/tree/src/crashtests/399227-2.xul
new file mode 100644
index 00000000000..abfe12ce7c4
--- /dev/null
+++ b/layout/xul/base/src/tree/src/crashtests/399227-2.xul
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
+
+
+  <script>
+  function boom()
+  {
+    var tree = document.getElementById("thetree");
+    var selection = tree.view.selection;
+    var treecolumn0 = tree.columns[0];
+    var treecolumn1 = tree.columns[1];
+
+    selection.select(0);
+    selection.currentColumn = treecolumn0;
+    tree.parentNode.removeChild(tree);
+    selection.currentColumn = treecolumn1;
+  }
+  </script>
+
+<tree flex="1" id="thetree" seltype="cell">
+    <treecols>
+      <treecol label="Name"/>
+      <treecol label="Test"/>
+    </treecols>
+    <treechildren id="TC">
+      <treeitem id="TI1">
+        <treerow>
+          <treecell label="First treecell"/>
+          <treecell label="Second treecell"/>
+        </treerow>
+      </treeitem>
+      <treeitem id="TI2">
+        <treerow>
+          <treecell label="Third treecell"/>
+          <treecell label="Fourth treecell"/>
+        </treerow>
+      </treeitem>
+    </treechildren>
+  </tree>
+</window>
diff --git a/layout/xul/base/src/tree/src/crashtests/crashtests.list b/layout/xul/base/src/tree/src/crashtests/crashtests.list
index decf92ebd3d..e3c7ae0c22a 100644
--- a/layout/xul/base/src/tree/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/tree/src/crashtests/crashtests.list
@@ -4,6 +4,8 @@ load 309732-2.xul
 load 366583-1.xul
 load 380217-1.xul
 load 393665-1.xul
+load 399227-1.xul
+load 399227-2.xul
 load 399692-1.xhtml
 load 399715-1.xhtml
 load 409807-1.xul
diff --git a/layout/xul/base/src/tree/src/nsTreeSelection.cpp b/layout/xul/base/src/tree/src/nsTreeSelection.cpp
index 4f5ce665ce1..19bd221d6ae 100644
--- a/layout/xul/base/src/tree/src/nsTreeSelection.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeSelection.cpp
@@ -299,6 +299,9 @@ NS_IMETHODIMP nsTreeSelection::SetTree(nsITreeBoxObject * aTree)
 
 NS_IMETHODIMP nsTreeSelection::GetSingle(PRBool* aSingle)
 {
+  if (!mTree)
+    return NS_ERROR_NULL_POINTER;
+
   nsCOMPtr<nsIBoxObject> boxObject = do_QueryInterface(mTree);
 
   nsCOMPtr<nsIDOMElement> element;
@@ -410,8 +413,8 @@ NS_IMETHODIMP nsTreeSelection::ToggleSelect(PRInt32 aIndex)
   else {
     if (!mFirstRange->Contains(aIndex)) {
       PRBool single;
-      GetSingle(&single);
-      if (!single)
+      rv = GetSingle(&single);
+      if (NS_SUCCEEDED(rv) && !single)
         rv = mFirstRange->Add(aIndex);
     }
     else
@@ -430,7 +433,10 @@ NS_IMETHODIMP nsTreeSelection::ToggleSelect(PRInt32 aIndex)
 NS_IMETHODIMP nsTreeSelection::RangedSelect(PRInt32 aStartIndex, PRInt32 aEndIndex, PRBool aAugment)
 {
   PRBool single;
-  GetSingle(&single);
+  nsresult rv = GetSingle(&single);
+  if (NS_FAILED(rv))
+    return rv;
+
   if ((mFirstRange || (aStartIndex != aEndIndex)) && single)
     return NS_OK;
 
@@ -452,7 +458,7 @@ NS_IMETHODIMP nsTreeSelection::RangedSelect(PRInt32 aStartIndex, PRInt32 aEndInd
   }
 
   mShiftSelectPivot = aStartIndex;
-  nsresult rv = SetCurrentIndex(aEndIndex);
+  rv = SetCurrentIndex(aEndIndex);
   if (NS_FAILED(rv))
     return rv;
   
@@ -534,7 +540,10 @@ NS_IMETHODIMP nsTreeSelection::SelectAll()
   PRInt32 rowCount;
   view->GetRowCount(&rowCount);
   PRBool single;
-  GetSingle(&single);
+  nsresult rv = GetSingle(&single);
+  if (NS_FAILED(rv))
+    return rv;
+
   if (rowCount == 0 || (rowCount > 1 && single))
     return NS_OK;
 
@@ -658,6 +667,9 @@ NS_IMETHODIMP nsTreeSelection::GetCurrentColumn(nsITreeColumn** aCurrentColumn)
 
 NS_IMETHODIMP nsTreeSelection::SetCurrentColumn(nsITreeColumn* aCurrentColumn)
 {
+  if (!mTree) {
+    return NS_ERROR_UNEXPECTED;
+  }
   if (mCurrentColumn == aCurrentColumn) {
     return NS_OK;
   }