When we migrate AIM buddy lists (this will be available by PR2 freeze on 5/16), I crash in table code. Here is the stack: sVoidArray::ElementAt(int 0x00000000) line 120 + 6 bytes nsCellMap::ShrinkWithoutRows(nsTableCellMap & {...}, int 0x00000001, int 0x00000002) line 1068 + 13 bytes nsCellMap::RemoveRows(nsIPresContext * 0x0379cbb0, nsTableCellMap & {...}, int 0x00000001, int 0x00000002, int 0x00000000) line 662 nsTableCellMap::RemoveRows(nsIPresContext * 0x0379cbb0, int 0x00000001, int 0x00000002, int 0x00000000) line 300 nsTableFrame::RemoveRows(nsIPresContext & {...}, int 0x00000001, int 0x00000002, int 0x00000000) line 1042 nsTreeRowGroupFrame::OnContentRemoved(nsIPresContext * 0x0379cbb0, nsIFrame * 0x02aac854, int 0x00000000) line 1520 nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x037cd190, nsIPresContext * 0x0379cbb0, nsIContent * 0x043f7640, nsIContent * 0x043d0740, int 0x00000000) line 8713 StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x037cd250, nsIPresContext * 0x0379cbb0, nsIContent * 0x043f7640, nsIContent * 0x043d0740, int 0x00000000) line 1047 PresShell::ContentRemoved(PresShell * const 0x037ced78, nsIDocument * 0x0379ab30, nsIContent * 0x043f7640, nsIContent * 0x043d0740, int 0x00000000) line 3049 + 50 bytes nsXULDocument::ContentRemoved(nsXULDocument * const 0x0379ab30, nsIContent * 0x043f7640, nsIContent * 0x043d0740, int 0x00000000) line 1631 nsXULElement::RemoveChildAt(nsXULElement * const 0x043f7640, int 0x00000000, int 0x00000001) line 2627 nsXULTemplateBuilder::RemoveMember(nsIContent * 0x03911650, nsIRDFResource * 0x043f67d0, int 0x00000001) line 5533 + 38 bytes nsXULTemplateBuilder::Retract(nsIRDFResource * 0x0343c060, nsIRDFResource * 0x010edf60, nsIRDFNode * 0x043f67d0) line 4519 nsXULTemplateBuilder::OnUnassert(nsXULTemplateBuilder * const 0x039121c8, nsIRDFResource * 0x0343c060, nsIRDFResource * 0x010edf60, nsIRDFNode * 0x043f67d0) line 4554 + 23 bytes CompositeDataSourceImpl::OnUnassert(CompositeDataSourceImpl * const 0x039139d4, nsIRDFResource * 0x0343c060, nsIRDFResource * 0x010edf60, nsIRDFNode * 0x043f67d0) line 1455 InMemoryDataSource::Unassert(InMemoryDataSource * const 0x038d18c0, nsIRDFResource * 0x0343c060, nsIRDFResource * 0x010edf60, nsIRDFNode * 0x043f67d0) line 1263 RDFContainerImpl::RemoveElement(RDFContainerImpl * const 0x0448b1d0, nsIRDFNode * 0x043f67d0, int 0x00000001) line 261 + 38 bytes nsCAimDataSource::RemoveRDFBuddyGroup(nsCAimDataSource * const 0x038cf6e0, nsIRDFResource * 0x043d8160) line 540 + 34 bytes nsCAimDataSource::RemoveAllBuddyGroups(nsCAimDataSource * const 0x038cf6e0) line 605 + 21 bytes nsCAimBuddy::ResynchronizeBuddyUI(nsCAimBuddy * const 0x038d2090) line 1922 nsCAimBuddy::AddGroupWithCommitFlag(nsCAimBuddy * const 0x038d2090, const unsigned short * 0x043d81a0, const unsigned short * 0x00000000, int 0x00000000) line 211 nsCAimBuddy::ImportSystemBuddyList(nsCAimBuddy * const 0x038d2090, nsISupports * 0x043d8410, int * 0x0012e4fc) line 1501 nsAimMigratorWindows::AimMigratorMigrateBuddyList(nsAimMigratorWindows * const 0x044841f0, const char * 0x043d84a0, int * 0x0012e6a8) line 180 XPTC_InvokeByIndex(nsISupports * 0x044841f0, unsigned int 0x00000009, unsigned int 0x00000002, nsXPTCVariant * 0x0012e698) line 139 nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x02cb4470, nsXPCWrappedNative * 0x043d8700, const XPCNativeMemberDescriptor * 0x043b448c, nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 0x00000001, long * 0x00ef8e04, long * 0x0012e848) line 914 + 43 bytes WrappedNative_CallMethod(JSContext * 0x02cb4470, JSObject * 0x02a31f98, unsigned int 0x00000001, long * 0x00ef8e04, long * 0x0012e848) line 200 + 34 bytes js_Invoke(JSContext * 0x02cb4470, unsigned int 0x00000001, unsigned int 0x00000000) line 686 + 23 bytes js_Interpret(JSContext * 0x02cb4470, long * 0x0012f17c) line 2485 + 15 bytes js_Invoke(JSContext * 0x02cb4470, unsigned int 0x00000003, unsigned int 0x00000002) line 702 + 13 bytes nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x0342d3b0, nsXPCWrappedJS * 0x03eefb90, unsigned short 0x0003, const nsXPTMethodInfo * 0x00e54720, nsXPTCMiniVariant * 0x0012f440) line 737 + 22 bytes nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x03eefb90, unsigned short 0x0003, const nsXPTMethodInfo * 0x00e54720, nsXPTCMiniVariant * 0x0012f440) line 310 PrepareAndDispatch(nsXPTCStubBase * 0x03eefb90, unsigned int 0x00000003, unsigned int * 0x0012f4f4, unsigned int * 0x0012f4e0) line 100 + 31 bytes SharedStub() line 125 The code isn't checking to see if it has a valid row it appears: nsVoidArray* row = (nsVoidArray *)(mRows.ElementAt(rowX)); PRInt32 colX; for (colX = 0; colX < colCount; colX++) { // dereferences row, even if it is NULL (which is what it is when we crash)

Syd, can you tell me what I need to do to reproduce this. I haven't done a commercial build in several months.

Do you need help pulling a build? Once you have it built, the way to dup this is to run NS6 on a system that you have installed AOL instant messenger on, and have added some buddies to the buddy list. Then, start up NS6, create a new profile, log into IM and do the migration wizard, selecting the screen name for the user in AIM that you have buddies in the buddy list for. When you log into NS aim, you will crash.

Since there are trees involved and they frequently destroy and recreate rows, I'm reassigning to Hyatt. The table thinks there are rows 1 and 2 which need to be removed.

Putting on dogfood plus radar

fixing this bug is throwaway work. requesting reconsideration. let me write tree on top of grid. this kind of bullshit is a waste of my time.

Remains a [dogfood+] bug. Don't care how we end up fixing it...just would like it fixed.

Mass-moving all dogfood+ bugs to M16

Isn't this bug, for Netscape to fix. It is dealing with AOL's Instant Messanger

[dogfood+] to retest once new tree work lands.

fixed.

I no longer see this crash during or after a migration of the buddy list. Verifying all platforms Win32 2000-06-23-09M17 Mac and Linux 2000-06-23-08M17