125687 - ASSERTION: bad row: 'aIndex >= 0 && aIndex < mRows.Count()', file f:\build\mozilla\content\xul\templates\src\nsXULOutlinerBuilder.cpp, line 491

Status: NEW

(Core :: XUL, defect, P3)

Description

[timeless]

nsXULOutlinerBuilder::IsContainer(nsXULOutlinerBuilder * const 0x072e6768, int 
-8, int * 0x0012c270) line 491 + 48 bytes
nsOutlinerBodyFrame::PrefillPropertyArray(int -8, nsOutlinerColumn * 
0x00000000) line 1576
nsOutlinerBodyFrame::PaintRow(nsOutlinerBodyFrame * const 0x06751820, int -8, 
const nsRect & {...}, nsIPresContext * 0x06655d90, nsIRenderingContext & {...}, 
const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Underlay) line 1994

-8 is a really bad index ...
nsOutlinerBodyFrame::Paint(nsOutlinerBodyFrame * const 0x06751820, 
nsIPresContext * 0x06655d90, nsIRenderingContext & {...}, const nsRect & {...}, 
nsFramePaintLayer eFramePaintLayer_Underlay, unsigned int 0) line 1924
/*
-	this	0x06751820
	mRefCnt	0
	mTopRowIndex	-8
	mPageCount	24
*/

it's based on mTopRowIndex, finding the setter for that is a bit of a chore, 
the only suggestion i have is to make this take a PRUint32: 
nsOutlinerBodyFrame::ScrollInternal(PRInt32 aRow) 

Actually. mTopRowIndex should never be negative, right? perhaps you should 
change it to unsigned and check for signed warnings :-)
PresShell::Paint(PresShell * const 0x06656ce4, nsIView * 0x0769f8d0, 
nsIRenderingContext & {...}, const nsRect & {...}) line 5707 + 36 bytes
nsView::Paint(nsView * const 0x0769f8d0, nsIRenderingContext & {...}, const 
nsRect & {...}, unsigned int 0, int & 1230128) line 275
nsViewManager::RenderDisplayListElement(DisplayListElement2 * 0x0519b210, 
nsIRenderingContext & {...}) line 1176
nsViewManager::RenderViews(nsView * 0x0769f8d0, nsIRenderingContext & {...}, 
const nsRect & {...}, int & 0) line 1125
nsViewManager::Refresh(nsView * 0x0769f8d0, nsIRenderingContext * 0x0519b3c0, 
nsIRegion * 0x0519d030, unsigned int 1) line 723
nsViewManager::DispatchEvent(nsViewManager * const 0x06655650, nsGUIEvent * 
0x0012c83c, nsEventStatus * 0x0012c750) line 1690
HandleEvent(nsGUIEvent * 0x0012c83c) line 83
nsWindow::DispatchEvent(nsWindow * const 0x0769f7a4, nsGUIEvent * 0x0012c83c, 
nsEventStatus & nsEventStatus_eIgnore) line 850 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012c83c, nsEventStatus & 
nsEventStatus_eIgnore) line 876
nsWindow::OnPaint() line 4336 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long * 
0x0012cc58) line 3244 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x001b18e0, unsigned int 15, unsigned int 0, long 
0) line 1115 + 27 bytes
USER32! 77e12e98()
USER32! 77e139a3()
USER32! 77e1395f()
NTDLL! 77fa032f()
nsOutlinerBodyFrame::ScrollInternal(int -8) line 2943
nsOutlinerBodyFrame::ScrollToRow(nsOutlinerBodyFrame * const 0x0675185c, int 
-8) line 2849
nsOutlinerBodyFrame::SetBounds(nsOutlinerBodyFrame * const 0x0675184c, 
nsBoxLayoutState & {...}, const nsRect & {...}) line 582
nsSprocketLayout::Layout(nsSprocketLayout * const 0x03bf6130, nsIBox * 
0x06751688, nsBoxLayoutState & {...}) line 493
nsContainerBox::DoLayout(nsContainerBox * const 0x06751688, nsBoxLayoutState & 
{...}) line 606 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x06751688, nsBoxLayoutState & {...}) 
line 1198
nsBox::Layout(nsBox * const 0x06751688, nsBoxLayoutState & {...}) line 1052
nsSprocketLayout::Layout(nsSprocketLayout * const 0x03bf6130, nsIBox * 
0x067515a8, nsBoxLayoutState & {...}) line 528
nsContainerBox::DoLayout(nsContainerBox * const 0x067515a8, nsBoxLayoutState & 
{...}) line 606 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x067515a8, nsBoxLayoutState & {...}) 
line 1198
nsBox::Layout(nsBox * const 0x067515a8, nsBoxLayoutState & {...}) line 1052
nsSprocketLayout::Layout(nsSprocketLayout * const 0x03bf6130, nsIBox * 
0x0103e490, nsBoxLayoutState & {...}) line 528
nsContainerBox::DoLayout(nsContainerBox * const 0x0103e490, nsBoxLayoutState & 
{...}) line 606 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x0103e490, nsBoxLayoutState & {...}) 
line 1198
nsBox::Layout(nsBox * const 0x0103e490, nsBoxLayoutState & {...}) line 1052
nsSprocketLayout::Layout(nsSprocketLayout * const 0x03bf6130, nsIBox * 
0x01022668, nsBoxLayoutState & {...}) line 528
nsContainerBox::DoLayout(nsContainerBox * const 0x01022668, nsBoxLayoutState & 
{...}) line 606 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x01022668, nsBoxLayoutState & {...}) 
line 1198
nsBox::Layout(nsBox * const 0x01022668, nsBoxLayoutState & {...}) line 1052
nsSprocketLayout::Layout(nsSprocketLayout * const 0x03bf6130, nsIBox * 
0x01022580, nsBoxLayoutState & {...}) line 528
nsContainerBox::DoLayout(nsContainerBox * const 0x01022580, nsBoxLayoutState & 
{...}) line 606 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x01022580, nsBoxLayoutState & {...}) 
line 1198
nsBox::Layout(nsBox * const 0x01022580, nsBoxLayoutState & {...}) line 1052
nsSprocketLayout::Layout(nsSprocketLayout * const 0x03bf6130, nsIBox * 
0x01022498, nsBoxLayoutState & {...}) line 528
nsContainerBox::DoLayout(nsContainerBox * const 0x01022498, nsBoxLayoutState & 
{...}) line 606 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x01022498, nsBoxLayoutState & {...}) 
line 1198
nsBox::Layout(nsBox * const 0x01022498, nsBoxLayoutState & {...}) line 1052
nsSprocketLayout::Layout(nsSprocketLayout * const 0x03bf6130, nsIBox * 
0x01021d28, nsBoxLayoutState & {...}) line 528
nsContainerBox::DoLayout(nsContainerBox * const 0x01021d28, nsBoxLayoutState & 
{...}) line 606 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x01021d28, nsBoxLayoutState & {...}) 
line 1198
nsBox::Layout(nsBox * const 0x01021d28, nsBoxLayoutState & {...}) line 1052
nsSprocketLayout::Layout(nsSprocketLayout * const 0x03bf6130, nsIBox * 
0x00fb85a8, nsBoxLayoutState & {...}) line 528
nsContainerBox::DoLayout(nsContainerBox * const 0x00fb85a8, nsBoxLayoutState & 
{...}) line 606 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x00fb85a8, nsBoxLayoutState & {...}) 
line 1198
nsBox::Layout(nsBox * const 0x00fb85a8, nsBoxLayoutState & {...}) line 1052
nsStackLayout::Layout(nsStackLayout * const 0x03bf60f0, nsIBox * 0x00fb83a8, 
nsBoxLayoutState & {...}) line 331
nsContainerBox::DoLayout(nsContainerBox * const 0x00fb83a8, nsBoxLayoutState & 
{...}) line 606 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x00fb83a8, nsBoxLayoutState & {...}) 
line 1198
nsBox::Layout(nsBox * const 0x00fb83a8, nsBoxLayoutState & {...}) line 1052
nsBoxFrame::Reflow(nsBoxFrame * const 0x00fb8370, nsIPresContext * 0x06655d90, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 991
nsRootBoxFrame::Reflow(nsRootBoxFrame * const 0x00fb8370, nsIPresContext * 
0x06655d90, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 243
nsContainerFrame::ReflowChild(nsIFrame * 0x00fb8370, nsIPresContext * 
0x06655d90, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 
0, int 0, unsigned int 0, unsigned int & 0) line 761 + 31 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x00fb8220, nsIPresContext * 
0x06655d90, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 574
nsHTMLReflowCommand::Dispatch(nsIPresContext * 0x06655d90, nsHTMLReflowMetrics 
& {...}, const nsSize & {...}, nsIRenderingContext & {...}) line 217
PresShell::ProcessReflowCommand(nsVoidArray & {...}, int 0, nsHTMLReflowMetrics 
& {...}, nsSize & {...}, nsIRenderingContext & {...}) line 6202
PresShell::ProcessReflowCommands(int 0) line 6257
PresShell::FlushPendingNotifications(PresShell * const 0x06656ce0, int 0) line 
5039
nsEventStateManager::FlushPendingEvents(nsIPresContext * 0x06655d90) line 3886
nsEventStateManager::GenerateDragGesture(nsIPresContext * 0x06655d90, 
nsGUIEvent * 0x0012e9dc) line 1158
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x06f24b98, 
nsIPresContext * 0x06655d90, nsEvent * 0x0012e9dc, nsIFrame * 0x0101c498, 
nsEventStatus * 0x0012e81c, nsIView * 0x07532f00) line 366
PresShell::HandleEventInternal(nsEvent * 0x0012e9dc, nsIView * 0x07532f00, 
unsigned int 1, nsEventStatus * 0x0012e81c) line 5994 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x06656ce4, nsIView * 0x07532f00, 
nsGUIEvent * 0x0012e9dc, nsEventStatus * 0x0012e81c, int 0, int & 1) line 5923 
+ 25 bytes
nsViewManager::HandleEvent(nsView * 0x066554a0, nsGUIEvent * 0x0012e9dc, int 0) 
line 2005
nsView::HandleEvent(nsViewManager * 0x06655650, nsGUIEvent * 0x0012e9dc, int 0) 
line 301
nsViewManager::DispatchEvent(nsViewManager * const 0x06655650, nsGUIEvent * 
0x0012e9dc, nsEventStatus * 0x0012e8dc) line 1838 + 23 bytes
HandleEvent(nsGUIEvent * 0x0012e9dc) line 83
nsWindow::DispatchEvent(nsWindow * const 0x06655374, nsGUIEvent * 0x0012e9dc, 
nsEventStatus & nsEventStatus_eIgnore) line 850 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012e9dc) line 871
nsWindow::DispatchMouseEvent(unsigned int 300, unsigned int 0, nsPoint * 
0x00000000) line 4537 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 300, unsigned int 0, nsPoint * 
0x00000000) line 4789
nsWindow::ProcessMessage(unsigned int 512, unsigned int 0, long 15073726, long 
* 0x0012edd4) line 3406 + 28 bytes
nsWindow::WindowProc(HWND__ * 0x000f1560, unsigned int 512, unsigned int 0, 
long 15073726) line 1115 + 27 bytes
USER32! 77e12e98()
USER32! 77e130e0()
USER32! 77e15824()
nsXULWindow::ShowModal(nsXULWindow * const 0x0792dc50) line 288
nsWebShellWindow::ShowModal(nsWebShellWindow * const 0x0792dc50) line 1094
nsContentTreeOwner::ShowAsModal(nsContentTreeOwner * const 0x0795131c) line 434
nsWindowWatcher::OpenWindowJS(nsWindowWatcher * const 0x0353f264, nsIDOMWindow 
* 0x03b74a24, const char * 0x0172b968, const char * 0x0172c084, const char * 
0x0172c060, int 1, unsigned int 1, long * 0x0792f030, nsIDOMWindow * * 
0x0012f248) line 705
nsWindowWatcher::OpenWindow(nsWindowWatcher * const 0x0353f260, nsIDOMWindow * 
0x03b74a24, const char * 0x0172b968, const char * 0x0172c084, const char * 
0x0172c060, nsISupports * 0x0792f0b0, nsIDOMWindow * * 0x0012f248) line 451 + 
48 bytes
nsPromptService::DoDialog(nsPromptService * const 0x03bceeb4, nsIDOMWindow * 
0x03b74a24, nsIDialogParamBlock * 0x0792f0b0, const char * 0x0172b968) line 629 
+ 77 bytes
nsPromptService::PromptPassword(nsPromptService * const 0x03bceeb0, 
nsIDOMWindow * 0x00000000, const unsigned short * 0x0792d570, const unsigned 
short * 0x0792a470, unsigned short * * 0x0012f450, const unsigned short * 
0x00000000, int * 0x00000000, int * 0x0012f47c) line 536 + 39 bytes
nsPrompt::PromptPassword(nsPrompt * const 0x0792b7d0, const unsigned short * 
0x00000000, const unsigned short * 0x0792a470, unsigned short * * 0x0012f450, 
const unsigned short * 0x00000000, int * 0x00000000, int * 0x0012f47c) line 204
PK11PasswordPrompt(PK11SlotInfoStr * 0x0777c450, int 0, void * 0x0792bec0) line 
184 + 56 bytes
pk11_GetPassword(PK11SlotInfoStr * 0x0777c450, int 0, void * 0x0792bec0) line 
1038 + 18 bytes
PK11_DoPassword(PK11SlotInfoStr * 0x0777c450, int 1, void * 0x0792bec0) line 
1108 + 17 bytes
PK11_Authenticate(PK11SlotInfoStr * 0x0777c450, int 1, void * 0x0792bec0) line 
817 + 17 bytes
nsSecretDecoderRing::Decrypt(nsSecretDecoderRing * const 0x0792fd40, unsigned 
char * 0x0792b820, int 52, unsigned char * * 0x0012f52c, int * 0x0012f538) line 
181 + 20 bytes
nsSecretDecoderRing::DecryptString(nsSecretDecoderRing * const 0x0792fd40, 
const char * 0x0792b440, char * * 0x0012f570) line 245 + 28 bytes
DecryptString(const char * 0x0792b440, char * & 0x00000000) line 743 + 26 bytes
wallet_Decrypt(const nsCString & {...}, nsCString & {...}) line 807 + 21 bytes
Wallet_Decrypt(const nsString & {...}, nsString & {...}) line 828 + 26 bytes
Wallet_Decrypt2(const nsString & {...}, nsString & {...}) line 842 + 13 bytes
si_Decrypt(const nsString & {...}, nsString & {...}) line 613 + 13 bytes
si_RestoreOldSignonDataFromBrowser(nsIPrompt * 0x0795a900, const char * 
0x0012facc, int 1, nsString & {...}, nsString & {...}) line 2239 + 21 bytes
SINGSIGN_PromptPassword(const unsigned short * 0x0795aa50, const unsigned short 
* 0x0795fc60, unsigned short * * 0x0795fb20, const char * 0x0012facc, nsIPrompt 
* 0x0795a900, int * 0x0012fc9c, unsigned int 2) line 2415 + 45 bytes
nsSingleSignOnPrompt::PromptPassword(nsSingleSignOnPrompt * const 0x0795fbe0, 
const unsigned short * 0x0795aa50, const unsigned short * 0x0795fc60, const 
unsigned short * 0x0012fb5c, unsigned int 2, unsigned short * * 0x0795fb20, int 
* 0x0012fc9c) line 662 + 47 bytes
nsMsgIncomingServer::GetPasswordWithUI(nsMsgIncomingServer * const 0x06f6e6b0, 
const unsigned short * 0x0795fc60, const unsigned short * 0x0795aa50, 
nsIMsgWindow * 0x06182fa0, int * 0x0012fc9c, char * * 0x0795e6a0) line 760 + 
110 bytes
nsImapIncomingServer::PromptForPassword(nsImapIncomingServer * const 
0x06f6e708, char * * 0x0795e6a0, nsIMsgWindow * 0x06182fa0) line 2301 + 42 
bytes
XPTC_InvokeByIndex(nsISupports * 0x06f6e708, unsigned int 21, unsigned int 2, 
nsXPTCVariant * 0x0795c080) line 106
EventHandler(PLEvent * 0x0795afd0) line 515 + 41 bytes
PL_HandleEvent(PLEvent * 0x0795afd0) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x004b6c50) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x001b0c98, unsigned int 49605, unsigned int 0, 
long 4942928) line 1071 + 9 bytes
USER32! 77e12e98()
USER32! 77e130e0()
USER32! 77e15824()
nsAppShellService::Run(nsAppShellService * const 0x0353e5f0) line 308

Comment 1

[Jan Varga [:janv]]

bryner what about this:

NS_IMETHODIMP
nsOutlinerBodyFrame::SetBounds(nsBoxLayoutState& aBoxLayoutState, const nsRect&
aRect)
{
  PRBool recompute = (aRect != mRect);
  nsresult rv = nsLeafBoxFrame::SetBounds(aBoxLayoutState, aRect);

  if (recompute) {
    mInnerBox = GetInnerBox();
    mPageCount = mRowHeight ? (mInnerBox.height / mRowHeight) : 0;

    PRInt32 rowCount;
    mView->GetRowCount(&rowCount);

-    PRInt32 lastPageTopRow = rowCount - mPageCount;
+    PRInt32 lastPageTopRow = PR_MAX(0, rowCount - mPageCount);

    if (mTopRowIndex >= lastPageTopRow)
      ScrollToRow(lastPageTopRow);
  
    InvalidateScrollbar();
    CheckVerticalOverflow(aBoxLayoutState.GetReflowState() != nsnull);
  }

  return rv;
}

Comment 2

[Brian Ryner (not reading)]

r=bryner

Comment 3

[Jan Varga [:janv]]

timeless, how can I hit this assertion ?

Comment 4

[David Hyatt]

sr=hyatt

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

a=roc+moz for 0.9.9

Comment 6

[Jan Varga [:janv]]

fixed

Comment 7

[rbs]

re-opening. I still get this assertion. I will attach a screenshot and
document how to reproduce it.

Comment 8

[rbs]

Attachment: screenshot - assertion is firing

steps to reproduce:
1. click a twisty from the pref dialog
2. select an option in the expanded list
3. click the twisty to close (while the option is still selected)
   -> assertion

Comment 9

[Jan Varga [:janv]]

Yeah, I can reproduce it too.
But this time it's problem elsewhere.

Comment 10

[Jan Varga [:janv]]

Fix for bug 115894 also covers this bug.

Comment 11

[Jan Varga [:janv]]

Fixed along with bug 115894

Comment 12

[rbs]

Attachment: assertion is firing again

(I guess in this case Inspector wants to have its parent expanded and its entry

auto-selected -- the Inspector entry is not a top-level entry.)

Comment 13

[rbs]

-> re-opening. (it will be hard to cover this elsewhere this time :-)

Comment 14

[timeless]

Culrpit stack:
nsTreeBodyFrame::ScrollInternal(int -4) line 3301
nsTreeBodyFrame::PositionChanged(nsTreeBodyFrame * const 0x106cad8c, int 90, int
& -72) line 3347
nsSliderFrame::AttributeChanged(nsSliderFrame * const 0x106d0dac, nsIPresContext
* 0x10679530, nsIContent * 0x106cf668, int 0, nsIAtom * 0x03b66f18 {???}, int 1,
int 94) line 265
nsCSSFrameConstructor::AttributeChanged(nsCSSFrameConstructor * const
0x1064f720, nsIPresContext * 0x10679530, nsIContent * 0x106cf668, int 0, nsIAtom
* 0x03b66f18 {???}, int 1, nsChangeHint 14) line 10496 + 36 bytes
StyleSetImpl::AttributeChanged(StyleSetImpl * const 0x1064f5d0, nsIPresContext *
0x10679530, nsIContent * 0x106cf668, int 0, nsIAtom * 0x03b66f18 {???}, int 1,
nsChangeHint nsChangeHint_Unknown) line 1762
PresShell::AttributeChanged(PresShell * const 0x105fb1c8, nsIDocument *
0x10668090, nsIContent * 0x106cf668, int 0, nsIAtom * 0x03b66f18 {???}, int 1,
nsChangeHint nsChangeHint_Unknown) line 5330 + 61 bytes
nsXULDocument::AttributeChanged(nsXULDocument * const 0x10668090, nsIContent *
0x106cf668, int 0, nsIAtom * 0x03b66f18 {???}, int 1, nsChangeHint
nsChangeHint_Unknown) line 1154
nsXULElement::SetAttr(nsXULElement * const 0x106cf668, nsINodeInfo * 0x0e2a5150,
const nsAString & {...}, int 1) line 2572
nsXULElement::SetAttr(nsXULElement * const 0x106cf668, int 0, nsIAtom *
0x03b66f18 {???}, const nsAString & {...}, int 1) line 2591 + 29 bytes
nsXBLPrototypeBinding::AttributeChanged(nsIAtom * 0x03b66f18 {???}, int 0, int
0, nsIContent * 0x106cd238, nsIContent * 0x106cf110, int 1) line 500
nsXBLBinding::AttributeChanged(nsXBLBinding * const 0x106cef58, nsIAtom *
0x03b66f18 {???}, int 0, int 0, int 1) line 1051
nsXULElement::SetAttr(nsXULElement * const 0x106cd238, nsINodeInfo * 0x105012b0,
const nsAString & {...}, int 1) line 2536
nsXULElement::SetAttr(nsXULElement * const 0x106cd238, int 0, nsIAtom *
0x03b66f18 {???}, const nsAString & {...}, int 1) line 2591 + 29 bytes
nsTreeBodyFrame::InvalidateScrollbar(nsTreeBodyFrame * const 0x106cad84) line 1084
nsTreeBodyFrame::RowCountChanged(nsTreeBodyFrame * const 0x106cad84, int 14, int
-9) line 1752
nsTreeBoxObject::RowCountChanged(nsTreeBoxObject * const 0x106cb4a8, int 14, int
-9) line 423 + 20 bytes
nsTreeContentView::CloseContainer(int 13) line 1438
nsTreeContentView::AttributeChanged(nsTreeContentView * const 0x106fd060,
nsIDocument * 0x10668090, nsIContent * 0x105c8588, int 0, nsIAtom * 0x03b66cf8
{???}, int 1, nsChangeHint nsChangeHint_Unknown) line 825
nsXULDocument::AttributeChanged(nsXULDocument * const 0x10668090, nsIContent *
0x105c8588, int 0, nsIAtom * 0x03b66cf8 {???}, int 1, nsChangeHint
nsChangeHint_Unknown) line 1154
nsXULElement::SetAttr(nsXULElement * const 0x105c8588, nsINodeInfo * 0x1082a0d8,
const nsAString & {...}, int 1) line 2572
nsXULElement::SetAttr(nsXULElement * const 0x105c8588, int 0, nsIAtom *
0x03b66cf8 {???}, const nsAString & {...}, int 1) line 2591 + 29 bytes
nsTreeContentView::ToggleOpenState(nsTreeContentView * const 0x106fd058, int 13)
line 594 + 44 bytes
XPTC_InvokeByIndex(nsISupports * 0x106fd058, unsigned int 25, unsigned int 1,
nsXPTCVariant * 0x0012d638) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2023 + 42 bytes

steps:
* edit>preferences
* expand navigator
* expand advanced
* scroll to bottom
* collapse advanced

Breakpoint that counts:
nsTreeBodyFrame::ScrollInternal(PRInt32 aRow)
  mTopRowIndex += delta;

Variables at line:
	delta		-9
	mTopRowIndex	5

Comment 15

[timeless]

Attachment: fix

Comment 16

[[e-mail]]

Comment on attachment 124369 [details] [diff] [review]
fix

This is just wallpaper, because someone is passing in negative rows when they
shouldn't, and we ought to find out why. And if you still want to do this, you
should limit the row to between 0 and (last row - visible rows + 1).

Comment 17

[Jan Varga [:janv]]

I agree with Neil

Comment 18

[Jan Varga [:janv]]

Comment on attachment 124369 [details] [diff] [review]
fix

per last comments

Comment 19

[Vedran Miletic]

retargeting

Comment 20

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, so the assignee is being reset.