37472 - Assertion and then crash while trying to remove groups from the end

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[prass]

After buddy and group deletes, the scroll bar tries to adjust itself 
according to current buddylist. At this point a delete group throwsan 
assertion. On ignoring this assertion, the next delete group crashes seamonkey.
Steps to reproduce:

1. rm ~/.mozilla
2. Login to Aim
3. Add 2 additional groups (to thd efault three groups)
4. Add 3 online buddies to all 5 groups.
5. Observe the scroll list that comes up when all groups are expanded.
6. From the last group, delete each buddy.
7. From the second and third group, delete a buddy
8. From the bottom up, delete group
9. When it is time for the scrollbar to adjust (or disappear), doing a delte 
buddy throws the following assertion:
NTDLL! 77f76274()
nsDebug::Assertion(const char * 0x02536298, const char * 0x02536278, const char 
* 0x02536238, int 324) line 191 + 13 bytes
nsTreeRowGroupFrame::ConstructContentChain(nsIContent * 0x00000000) line 324 + 
42 bytes
nsTreeRowGroupFrame::PositionChanged(nsTreeRowGroupFrame * const 0x02bcf64c, 
nsIPresContext * 0x03aab360, int 64, int 48) line 755
nsSliderFrame::CurrentPositionChanged(nsIPresContext * 0x03aab360) line 595
nsSliderFrame::AttributeChanged(nsSliderFrame * const 0x02c3c7f4, nsIPresContext 
* 0x03aab360, nsIContent * 0x03d77f90, int 0, nsIAtom * 0x010ae820, int 2) line 
161 + 18 bytes
nsCSSFrameConstructor::AttributeChanged(nsCSSFrameConstructor * const 
0x03af90f0, nsIPresContext * 0x03aab360, nsIContent * 0x03d77f90, int 0, nsIAtom 
* 0x010ae820, int 2) line 9430 + 35 bytes
StyleSetImpl::AttributeChanged(StyleSetImpl * const 0x03af91b0, nsIPresContext * 
0x03aab360, nsIContent * 0x03d77f90, int 0, nsIAtom * 0x010ae820, int -1) line 
1076
PresShell::AttributeChanged(PresShell * const 0x03afad88, nsIDocument * 
0x03aad930, nsIContent * 0x03d77f90, int 0, nsIAtom * 0x010ae820, int -1) line 
2793 + 57 bytes
nsXULDocument::AttributeChanged(nsXULDocument * const 0x03aad930, nsIContent * 
0x03d77f90, int 0, nsIAtom * 0x010ae820, int -1) line 1489
nsXULElement::SetAttribute(nsXULElement * const 0x03d77f90, int 0, nsIAtom * 
0x010ae820, const nsString & {...}, int 1) line 2832
nsXBLBinding::AttributeChanged(nsXBLBinding * const 0x03d76430, nsIAtom * 
0x010ae820, int 0, int 0) line 947
nsXULElement::SetAttribute(nsXULElement * const 0x03d76b30, int 0, nsIAtom * 
0x010ae820, const nsString & {...}, int 1) line 2828
nsTreeRowGroupFrame::OnContentRemoved(nsIPresContext * 0x03aab360, nsIFrame * 
0x02bfef30, int 1) line 1494
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x03af90f0, 
nsIPresContext * 0x03aab360, nsIContent * 0x03d7a080, nsIContent * 0x041416d0, 
int 1) line 8625
StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x03af91b0, nsIPresContext * 
0x03aab360, nsIContent * 0x03d7a080, nsIContent * 0x041416d0, int 1) line 1047
PresShell::ContentRemoved(PresShell * const 0x03afad88, nsIDocument * 
0x03aad930, nsIContent * 0x03d7a080, nsIContent * 0x041416d0, int 1) line 2864 + 
50 bytes
nsXULDocument::ContentRemoved(nsXULDocument * const 0x03aad930, nsIContent * 
0x03d7a080, nsIContent * 0x041416d0, int 1) line 1622
nsXULElement::RemoveChildAt(nsXULElement * const 0x03d7a080, int 1, int 1) line 
2585
nsXULTemplateBuilder::RemoveMember(nsIContent * 0x03bdbee0, nsIRDFResource * 
0x0413b050, int 1) line 5106 + 38 bytes
nsXULTemplateBuilder::Retract(nsIRDFResource * 0x0323fca0, nsIRDFResource * 
0x02d43cb0, nsIRDFNode * 0x0413b050) line 4075
nsXULTemplateBuilder::OnUnassert(nsXULTemplateBuilder * const 0x03bdc8d4, 
nsIRDFResource * 0x0323fca0, nsIRDFResource * 0x02d43cb0, nsIRDFNode * 
0x0413b050) line 4110 + 23 bytes
CompositeDataSourceImpl::OnUnassert(CompositeDataSourceImpl * const 0x03bdc104, 
nsIRDFResource * 0x0323fca0, nsIRDFResource * 0x02d43cb0, nsIRDFNode * 
0x0413b050) line 1455
InMemoryDataSource::Unassert(InMemoryDataSource * const 0x032898e0, 
nsIRDFResource * 0x0323fca0, nsIRDFResource * 0x02d43cb0, nsIRDFNode * 
0x0413b050) line 1263
RDFContainerImpl::RemoveElement(RDFContainerImpl * const 0x04593db0, nsIRDFNode 
* 0x0413b050, int 1) line 263 + 38 bytes
nsCAimDataSource::RemoveBuddyGroup(nsCAimDataSource * const 0x0323fce0, const 
char * 0x0012e238) line 510 + 43 bytes
nsCAimBuddy::RemoveGroup(nsCAimBuddy * const 0x0328a390, const unsigned short * 
0x044da650) line 253 + 22 bytes
XPTC_InvokeByIndex(nsISupports * 0x0328a390, unsigned int 5, unsigned int 1, 
nsXPTCVariant * 0x0012e414) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x02fa8820, 
nsXPCWrappedNative * 0x04590e10, const XPCNativeMemberDescriptor * 0x0459084c, 
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 1, long * 
0x00e26dc4, long * 0x0012e5c4) line 898 + 43 bytes
WrappedNative_CallMethod(JSContext * 0x02fa8820, JSObject * 0x02b7e548, unsigned 
int 1, long * 0x00e26dc4, long * 0x0012e5c4) line 200 + 34 bytes
js_Invoke(JSContext * 0x02fa8820, unsigned int 1, unsigned int 0) line 686 + 23 
bytes
js_Interpret(JSContext * 0x02fa8820, long * 0x0012eeec) line 2483 + 15 bytes
js_Invoke(JSContext * 0x02fa8820, unsigned int 1, unsigned int 2) line 702 + 13 
bytes
js_InternalInvoke(JSContext * 0x02fa8820, JSObject * 0x00eaef68, long 45504872, 
unsigned int 0, unsigned int 1, long * 0x0012f084, long * 0x0012f024) line 775 + 
19 bytes
JS_CallFunctionValue(JSContext * 0x02fa8820, JSObject * 0x00eaef68, long 
45504872, unsigned int 1, long * 0x0012f084, long * 0x0012f024) line 2794 + 31 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x02fa89b0, void * 0x00eaef68, 
void * 0x02b65968, unsigned int 1, void * 0x0012f084, int * 0x0012f080, int 0) 
line 787 + 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x044dee24) line 154 + 64 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x032d0c50, 
nsIDOMEvent * 0x044dee24, unsigned int 8, unsigned int 7) line 703 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x02fac150, nsEvent * 
0x0012f5ac, nsIDOMEvent * * 0x0012f580, unsigned int 7, nsEventStatus * 
0x0012f5ec) line 1477 + 35 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x032d0da0, nsIPresContext * 
0x02fac150, nsEvent * 0x0012f5ac, nsIDOMEvent * * 0x0012f580, unsigned int 1, 
nsEventStatus * 0x0012f5ec) line 3294
nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x02fac150) line 114
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x00ef9bfc, 
nsIPresContext * 0x02fac150, nsGUIEvent * 0x0012f67c, nsEventStatus * 
0x0012f938) line 96
PresShell::HandleEventInternal(nsEvent * 0x0012f67c, nsIView * 0x00000000, 
nsEventStatus * 0x0012f938) line 3394 + 38 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x03033d80, nsEvent * 
0x0012f67c, nsIFrame * 0x00ef9bfc, nsIContent * 0x032d0da0, nsEventStatus * 
0x0012f938) line 3360 + 18 bytes
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 
0x03a5f470, nsIPresContext * 0x02fac150, nsMouseEvent * 0x0012fa2c, 
nsEventStatus * 0x0012f938) line 1581 + 50 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x03a5f470, 
nsIPresContext * 0x02fac150, nsEvent * 0x0012fa2c, nsIFrame * 0x00ef9bfc, 
nsEventStatus * 0x0012f938, nsIView * 0x03037570) line 730 + 24 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012fa2c, nsIView * 0x03037570, 
nsEventStatus * 0x0012f938) line 3399 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x03033d84, nsIView * 0x03037570, 
nsGUIEvent * 0x0012fa2c, nsEventStatus * 0x0012f938, int & 1) line 3314 + 23 
bytes
nsView::HandleEvent(nsView * const 0x03037570, nsGUIEvent * 0x0012fa2c, unsigned 
int 28, nsEventStatus * 0x0012f938, int & 1) line 774
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x03037750, nsGUIEvent * 
0x0012fa2c, nsEventStatus * 0x0012f938) line 1372
HandleEvent(nsGUIEvent * 0x0012fa2c) line 69
nsWindow::DispatchEvent(nsWindow * const 0x03037444, nsGUIEvent * 0x0012fa2c, 
nsEventStatus & nsEventStatus_eIgnore) line 511 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fa2c) line 532
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3291 + 
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 
3498
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 3211362, long * 
0x0012fd90) line 2441 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x00f40354, unsigned int 514, unsigned int 0, long 
3211362) line 764 + 27 bytes
USER32! 77e71268()
JS3250! js_boolean_str + 2 bytes


10. Click ignore. Observe that the tree shows group name but some of the buddies 
are missing at this point.
11. Delete the last(topmost) group.
12. Observe Crash



Stack Trace:
00000d5c()
nsTableFrame::AdjustForCollapsingCols(nsTableFrame * const 0x02bdcadc, 
nsIPresContext * 0x03aab360, int & 3420) line 2168
nsTableFrame::ResizeReflowPass2(nsTableFrame * const 0x02bdcadc, nsIPresContext 
* 0x03aab360, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 1988
nsTableFrame::Reflow(nsTableFrame * const 0x02bdcadc, nsIPresContext * 
0x03aab360, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 1609 + 34 bytes
nsTreeFrame::Reflow(nsTreeFrame * const 0x02bdcadc, nsIPresContext * 0x03aab360, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 421 + 25 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x02bdcadc, nsIPresContext * 
0x03aab360, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, 
int 0, unsigned int 3, unsigned int & 0) line 643 + 31 bytes
nsTableOuterFrame::IR_InnerTableReflow(nsTableOuterFrame * const 0x02bf40e8, 
nsIPresContext * 0x03aab360, nsHTMLReflowMetrics & {...}, OuterTableReflowState 
& {...}, unsigned int & 0) line 734 + 40 bytes
nsTableOuterFrame::IR_TargetIsInnerTableFrame(nsTableOuterFrame * const 
0x02bf40e8, nsIPresContext * 0x03aab360, nsHTMLReflowMetrics & {...}, 
OuterTableReflowState & {...}, unsigned int & 0) line 508 + 31 bytes
nsTableOuterFrame::IR_TargetIsChild(nsTableOuterFrame * const 0x02bf40e8, 
nsIPresContext * 0x03aab360, nsHTMLReflowMetrics & {...}, OuterTableReflowState 
& {...}, unsigned int & 0, nsIFrame * 0x02bdcadc) line 475 + 31 bytes
nsTableOuterFrame::IncrementalReflow(nsTableOuterFrame * const 0x02bf40e8, 
nsIPresContext * 0x03aab360, nsHTMLReflowMetrics & {...}, OuterTableReflowState 
& {...}, unsigned int & 0) line 455 + 35 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x02bf40e8, nsIPresContext * 
0x03aab360, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 968 + 31 bytes
nsTreeOuterFrame::Reflow(nsTreeOuterFrame * const 0x02bf40e8, nsIPresContext * 
0x03aab360, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 138 + 25 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x02bf40e8, const nsRect & {...}, 
int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 455 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 
0x02bdcc14, int * 0x0012e95c) line 3648 + 56 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x02bdcc14, int 
* 0x0012e95c, int 1) line 2935 + 23 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2742 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x02bf4c8c, nsIPresContext * 
0x03aab360, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 1611 + 15 bytes
nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState & {...}, nsIPresContext * 
0x03aab360, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0, int 0, int 0, int 3450, int 3030, int 1) line 660
nsBoxToBlockAdaptor::Layout(nsBoxToBlockAdaptor * const 0x02bf48cc, 
nsBoxLayoutState & {...}) line 329 + 52 bytes
nsSprocketLayout::Layout(nsSprocketLayout * const 0x014999a0, nsIBox * 
0x02bf4b8c, nsBoxLayoutState & {...}) line 365
nsContainerBox::Layout(nsContainerBox * const 0x02bf4b8c, nsBoxLayoutState & 
{...}) line 523 + 34 bytes
nsBoxFrame::Layout(nsBoxFrame * const 0x02bf4b8c, nsBoxLayoutState & {...}) line 
822
nsStackLayout::Layout(nsStackLayout * const 0x01499960, nsIBox * 0x02bdc950, 
nsBoxLayoutState & {...}) line 237
nsContainerBox::Layout(nsContainerBox * const 0x02bdc950, nsBoxLayoutState & 
{...}) line 523 + 34 bytes
nsBoxFrame::Layout(nsBoxFrame * const 0x02bdc950, nsBoxLayoutState & {...}) line 
822
nsDeckFrame::Layout(nsDeckFrame * const 0x02bdc950, nsBoxLayoutState & {...}) 
line 220 + 13 bytes
nsSprocketLayout::Layout(nsSprocketLayout * const 0x014999a0, nsIBox * 
0x02bf49f0, nsBoxLayoutState & {...}) line 365
nsContainerBox::Layout(nsContainerBox * const 0x02bf49f0, nsBoxLayoutState & 
{...}) line 523 + 34 bytes
nsBoxFrame::Layout(nsBoxFrame * const 0x02bf49f0, nsBoxLayoutState & {...}) line 
822
nsSprocketLayout::Layout(nsSprocketLayout * const 0x014999a0, nsIBox * 
0x02b6a008, nsBoxLayoutState & {...}) line 365
nsContainerBox::Layout(nsContainerBox * const 0x02b6a008, nsBoxLayoutState & 
{...}) line 523 + 34 bytes
nsBoxFrame::Layout(nsBoxFrame * const 0x02b6a008, nsBoxLayoutState & {...}) line 
822
nsSprocketLayout::Layout(nsSprocketLayout * const 0x014999a0, nsIBox * 
0x02b69340, nsBoxLayoutState & {...}) line 365
nsContainerBox::Layout(nsContainerBox * const 0x02b69340, nsBoxLayoutState & 
{...}) line 523 + 34 bytes
nsBoxFrame::Layout(nsBoxFrame * const 0x02b69340, nsBoxLayoutState & {...}) line 
822
nsStackLayout::Layout(nsStackLayout * const 0x01499960, nsIBox * 0x02b692ac, 
nsBoxLayoutState & {...}) line 237
nsContainerBox::Layout(nsContainerBox * const 0x02b692ac, nsBoxLayoutState & 
{...}) line 523 + 34 bytes
nsBoxFrame::Layout(nsBoxFrame * const 0x02b692ac, nsBoxLayoutState & {...}) line 
822
nsBoxFrame::Reflow(nsBoxFrame * const 0x02b69274, nsIPresContext * 0x03aab360, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 678
nsRootBoxFrame::Reflow(nsRootBoxFrame * const 0x02b69274, nsIPresContext * 
0x03aab360, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 207
nsContainerFrame::ReflowChild(nsIFrame * 0x02b69274, nsIPresContext * 
0x03aab360, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, 
int 0, unsigned int 0, unsigned int & 0) line 643 + 31 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x02b69238, nsIPresContext * 
0x03aab360, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 546
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x044a5180, 
nsIPresContext * 0x03aab360, nsHTMLReflowMetrics & {...}, const nsSize & {...}, 
nsIRenderingContext & {...}) line 145
PresShell::ProcessReflowCommands(int 1) line 3568
ReflowEvent::HandleEvent() line 3460
HandlePLEvent(ReflowEvent * 0x044a1200) line 3470
PL_HandleEvent(PLEvent * 0x044a1200) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x014afc90) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x01d003c6, unsigned int 49448, unsigned int 0, 
long 21691536) line 1030 + 9 bytes
USER32! 77e71268()

Comment 1

[Dawn Endico]

reassign to browser product

Comment 2

[Chris Waterson]

content chain is all tree code.

-> xptoolkit

Comment 3

[Peter Trudelle]

to hyatt for triage.

Comment 4

[Peter Trudelle]

[nsbeta2+]

Comment 5

[John Morrison]

I can't reproduce this on windows 95 with today verif. comm. build (20000524 
whatever). Is this now WORKSFORME, prass?

[I couldn't run IM on mac or linux today, so I couldn't check there, but this
was reported originally on windows].

Comment 6

[prass]

I still see this crash with the release bits from 2000-05-24-21-M16.
The added groups and columns must be big enought to cause a scroll bar to 
appear. 

Comment 7

[David Hyatt]

fixed.

Comment 8

[John Morrison]

This isn't crashing, but it is not working completely correctly, due to 
the general problem with losing scrollbars in trees (bug 43467).

Comment 9

[prass]

DO not see the crash anymore. Verifing.