This testcase causes: ###!!! ASSERTION: index out of range: '0 <= aIndex && aIndex < Count()', file ../../../dist/include/xpcom/nsVoidArray.h, line 81 This is with nsVoidArray::ElementAt (not FastElementAt) so I don't think this is a memory-safety violation. This happens both without and with the patch in bug 343087 comment 2.
this is a regression from bug 339246
Created attachment 228106 [details] [diff] [review] patch
I think I have a case (unminised) that crashes, but not crashes when I have the patch applied.
Comment on attachment 228106 [details] [diff] [review] patch I don't know why I thought I have to take aNumOrigCols instead of numCols inside nsCellMap::RebuildConsideringRows. Its plain wrong in the patch for bug 339246. Probably I played with it and then forgot to remove it.
Comment on attachment 228106 [details] [diff] [review] patch Sure.
fixed on trunk
fixed on branches by the cellmap branch patch
Crashtest checked in.