Closed Bug 39392 Opened 24 years ago Closed 24 years ago

Crashing when adding buddies to buddy list

Categories

(Core :: Layout: Tables, defect, P1)

x86
Windows NT
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: slogan, Assigned: hyatt)

References

Details

(Keywords: crash, Whiteboard: [dogfood+][nsbeta2-] ETA: 6/9)

When we migrate AIM buddy lists (this will be available by PR2 freeze on 5/16), 
I crash in table code.

Here is the stack:

sVoidArray::ElementAt(int 0x00000000) line 120 + 6 bytes
nsCellMap::ShrinkWithoutRows(nsTableCellMap & {...}, int 0x00000001, int 
0x00000002) line 1068 + 13 bytes
nsCellMap::RemoveRows(nsIPresContext * 0x0379cbb0, nsTableCellMap & {...}, int 
0x00000001, int 0x00000002, int 0x00000000) line 662
nsTableCellMap::RemoveRows(nsIPresContext * 0x0379cbb0, int 0x00000001, int 
0x00000002, int 0x00000000) line 300
nsTableFrame::RemoveRows(nsIPresContext & {...}, int 0x00000001, int 0x00000002, 
int 0x00000000) line 1042
nsTreeRowGroupFrame::OnContentRemoved(nsIPresContext * 0x0379cbb0, nsIFrame * 
0x02aac854, int 0x00000000) line 1520
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x037cd190, 
nsIPresContext * 0x0379cbb0, nsIContent * 0x043f7640, nsIContent * 0x043d0740, 
int 0x00000000) line 8713
StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x037cd250, nsIPresContext * 
0x0379cbb0, nsIContent * 0x043f7640, nsIContent * 0x043d0740, int 0x00000000) 
line 1047
PresShell::ContentRemoved(PresShell * const 0x037ced78, nsIDocument * 
0x0379ab30, nsIContent * 0x043f7640, nsIContent * 0x043d0740, int 0x00000000) 
line 3049 + 50 bytes
nsXULDocument::ContentRemoved(nsXULDocument * const 0x0379ab30, nsIContent * 
0x043f7640, nsIContent * 0x043d0740, int 0x00000000) line 1631
nsXULElement::RemoveChildAt(nsXULElement * const 0x043f7640, int 0x00000000, int 
0x00000001) line 2627
nsXULTemplateBuilder::RemoveMember(nsIContent * 0x03911650, nsIRDFResource * 
0x043f67d0, int 0x00000001) line 5533 + 38 bytes
nsXULTemplateBuilder::Retract(nsIRDFResource * 0x0343c060, nsIRDFResource * 
0x010edf60, nsIRDFNode * 0x043f67d0) line 4519
nsXULTemplateBuilder::OnUnassert(nsXULTemplateBuilder * const 0x039121c8, 
nsIRDFResource * 0x0343c060, nsIRDFResource * 0x010edf60, nsIRDFNode * 
0x043f67d0) line 4554 + 23 bytes
CompositeDataSourceImpl::OnUnassert(CompositeDataSourceImpl * const 0x039139d4, 
nsIRDFResource * 0x0343c060, nsIRDFResource * 0x010edf60, nsIRDFNode * 
0x043f67d0) line 1455
InMemoryDataSource::Unassert(InMemoryDataSource * const 0x038d18c0, 
nsIRDFResource * 0x0343c060, nsIRDFResource * 0x010edf60, nsIRDFNode * 
0x043f67d0) line 1263
RDFContainerImpl::RemoveElement(RDFContainerImpl * const 0x0448b1d0, nsIRDFNode 
* 0x043f67d0, int 0x00000001) line 261 + 38 bytes
nsCAimDataSource::RemoveRDFBuddyGroup(nsCAimDataSource * const 0x038cf6e0, 
nsIRDFResource * 0x043d8160) line 540 + 34 bytes
nsCAimDataSource::RemoveAllBuddyGroups(nsCAimDataSource * const 0x038cf6e0) line 
605 + 21 bytes
nsCAimBuddy::ResynchronizeBuddyUI(nsCAimBuddy * const 0x038d2090) line 1922
nsCAimBuddy::AddGroupWithCommitFlag(nsCAimBuddy * const 0x038d2090, const 
unsigned short * 0x043d81a0, const unsigned short * 0x00000000, int 0x00000000) 
line 211
nsCAimBuddy::ImportSystemBuddyList(nsCAimBuddy * const 0x038d2090, nsISupports * 
0x043d8410, int * 0x0012e4fc) line 1501
nsAimMigratorWindows::AimMigratorMigrateBuddyList(nsAimMigratorWindows * const 
0x044841f0, const char * 0x043d84a0, int * 0x0012e6a8) line 180
XPTC_InvokeByIndex(nsISupports * 0x044841f0, unsigned int 0x00000009, unsigned 
int 0x00000002, nsXPTCVariant * 0x0012e698) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x02cb4470, 
nsXPCWrappedNative * 0x043d8700, const XPCNativeMemberDescriptor * 0x043b448c, 
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 0x00000001, long * 
0x00ef8e04, long * 0x0012e848) line 914 + 43 bytes
WrappedNative_CallMethod(JSContext * 0x02cb4470, JSObject * 0x02a31f98, unsigned 
int 0x00000001, long * 0x00ef8e04, long * 0x0012e848) line 200 + 34 bytes
js_Invoke(JSContext * 0x02cb4470, unsigned int 0x00000001, unsigned int 
0x00000000) line 686 + 23 bytes
js_Interpret(JSContext * 0x02cb4470, long * 0x0012f17c) line 2485 + 15 bytes
js_Invoke(JSContext * 0x02cb4470, unsigned int 0x00000003, unsigned int 
0x00000002) line 702 + 13 bytes
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x0342d3b0, 
nsXPCWrappedJS * 0x03eefb90, unsigned short 0x0003, const nsXPTMethodInfo * 
0x00e54720, nsXPTCMiniVariant * 0x0012f440) line 737 + 22 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x03eefb90, unsigned short 
0x0003, const nsXPTMethodInfo * 0x00e54720, nsXPTCMiniVariant * 0x0012f440) line 
310
PrepareAndDispatch(nsXPTCStubBase * 0x03eefb90, unsigned int 0x00000003, 
unsigned int * 0x0012f4f4, unsigned int * 0x0012f4e0) line 100 + 31 bytes
SharedStub() line 125

The code isn't checking to see if it has a valid row it appears:

    nsVoidArray* row = (nsVoidArray *)(mRows.ElementAt(rowX));
    PRInt32 colX;
    for (colX = 0; colX < colCount; colX++) {

// dereferences row, even if it is NULL (which is what it is when we crash)
Severity: normal → critical
Keywords: crash
Severity: critical → blocker
Keywords: dogfood, nsbeta2
Priority: P3 → P1
Whiteboard: nsbeta2
Syd, can you tell me what I need to do to reproduce this. I haven't done a 
commercial build in several months.
Do you need help pulling a build?

Once you have it built, the way to dup this is to run NS6 on a system that you 
have installed AOL instant messenger on, and have added some buddies to the 
buddy list. 

Then, start up NS6, create a new profile, log into IM and do the migration 
wizard, selecting the screen name for the user in AIM that you have buddies in 
the buddy list for. When you log into NS aim, you will crash.
Since there are trees involved and they frequently destroy and recreate rows, 
I'm reassigning to Hyatt. The table thinks there are rows 1 and 2 which need to 
be removed.
Assignee: karnaze → hyatt
Whiteboard: nsbeta2
Putting on dogfood plus radar
Whiteboard: [dogfood+]
Blocks: 40158
fixing this bug is throwaway work.  requesting reconsideration.

let me write tree on top of grid.  this kind of bullshit is a waste of my time.

Whiteboard: [dogfood+] → [dogfood]
Remains a [dogfood+] bug.  Don't care how we end up fixing it...just would like 
it fixed.
Whiteboard: [dogfood] → [dogfood+]
Mass-moving all dogfood+ bugs to M16
Target Milestone: --- → M16
Isn't this bug, for Netscape to fix.  It is dealing with AOL's Instant Messanger
Whiteboard: [dogfood+] → [dogfood+] NEED ETA (mm/dd)
Whiteboard: [dogfood+] NEED ETA (mm/dd) → [dogfood+] ETA: 6 days after tree rewrite decision is made
Whiteboard: [dogfood+] ETA: 6 days after tree rewrite decision is made → [dogfood+][nsbeta2-] ETA: 6 days after tree rewrite decision is made
[dogfood+] to retest once new tree work lands.
Whiteboard: [dogfood+][nsbeta2-] ETA: 6 days after tree rewrite decision is made → [dogfood+][nsbeta2-] ETA: 6/9
fixed.
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
QA Contact: chrisd → scalkins
I no longer see this crash during or after a migration of the buddy list.
Verifying all platforms
Win32 2000-06-23-09M17
Mac and Linux  2000-06-23-08M17
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.