I can reliably crash today's trunk build doing this: 1. Make new mail compose window 2. Enter 4-5 addressees, by typing each name, then hitting return. There should be enough addressees that the scrollbar in the addressing widget gets enabled. 3. Grab the thumb of the scrollbar with the mouse, and drag it up and and down. You'll crash.

Stack for the crash: 00000000 PPC 3D6D1718 0D3312A0 PPC 3D6BC820 main+00130 0D331240 PPC 3D6BBBDC main1(int, char**, nsISupports*)+00C98 0D330F10 PPC 3D515400 nsAppShellService::Run()+00018 0D330ED0 PPC 3D1DC5D8 nsAppShell::Run()+00048 0D330E80 PPC 3D1DD028 nsMacMessagePump::DoMessagePump()+0003C 0D330E30 PPC 3D1DD368 nsMacMessagePump::DispatchEvent(int, EventRecord*)+ 0005C 0D330DE0 PPC 3D1DD700 nsMacMessagePump::DoMouseDown(EventRecord&)+00148 0D330D10 PPC 3D1DE19C nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort *)+00040 0D330CC0 PPC 3D1D9BA8 nsMacMessageSink::DispatchOSEvent(EventRecord&, GrafPort*)+0006C 0D330C60 PPC 3D1D4838 nsMacWindow::HandleOSEvent(EventRecord&)+00020 0D330C20 PPC 3D1D58A8 nsMacEventHandler::HandleOSEvent(EventRecord&)+000AC 0D330BD0 PPC 3D1D70CC nsMacEventHandler::HandleMouseDownEvent(EventRecord& )+00478 0D3309B0 PPC 3D1C735C nsWindow::DispatchMouseEvent(nsMouseEvent&)+00054 0D330950 PPC 3D1C7218 nsWindow::DispatchWindowEvent(nsGUIEvent&)+00018 0D330910 PPC 3D1C7144 nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus& )+00094 0D3308C0 PPC 3C975FCC HandleEvent(nsGUIEvent*)+00058 0D330870 PPC 3C987BE4 nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*)+00694 0D330740 PPC 3C976B44 nsView::HandleEvent(nsGUIEvent*, unsigned int, nsEventStatus*, i nt, int&)+001B8 0D3306A0 PPC 3C976B44 nsView::HandleEvent(nsGUIEvent*, unsigned int, nsEventStatus*, i nt, int&)+001B8 0D330600 PPC 3C976BD4 nsView::HandleEvent(nsGUIEvent*, unsigned int, nsEventStatus*, i nt, int&)+00248 0D330560 PPC 3C9CBED8 PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*, in t, int&)+0027C 0D3304F0 PPC 3C9CC228 PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned int, nsEventStatus*)+001D4 0D330490 PPC 3CAB66B4 nsSliderFrame::HandleEvent(nsIPresContext*, nsGUIEvent*, nsEvent Status*)+00740 0D330350 PPC 3C9AC8D0 nsFrame::HandleEvent(nsIPresContext*, nsGUIEvent*, nsEventStatus *)+000C8 0D3302B0 PPC 3CAB7CF8 nsSliderFrame::HandlePress(nsIPresContext*, nsGUIEvent*, nsEvent Status*)+000B0 0D330250 PPC 3CAB6958 nsSliderFrame::PageUpDown(nsIFrame*, int)+00098 0D3301E0 PPC 3CAB6E08 nsSliderFrame::SetCurrentPosition(nsIContent*, nsIFrame*, int)+0 0100 0D32FF50 PPC 3CB2545C NSGetModule+3CAC4 0D32FED0 PPC 3CB25980 NSGetModule+3CFE8 0D32FD70 PPC 3C9CA128 PresShell::FlushPendingNotifications(int)+00064 0D32FD20 PPC 3C9CD1FC PresShell::ProcessReflowCommands(int)+00218 0D32FC70 PPC 3C9C9CEC PresShell::HandlePostedReflowCallbacks()+00068 0D32FC20 PPC 3CB2780C NSGetModule+3EE74 0D32FB30 PPC 3CB1CB14 NSGetModule+3417C 0D32FA80 PPC 3CB1CAC8 NSGetModule+34130 0D32F9D0 PPC 3CB2020C NSGetModule+37874 0D32F790 PPC 3CAA14B8 nsCSSFrameConstructor::CreateTreeWidgetContent(nsIPresContext*, nsIFrame*, nsIFrame*, nsIContent*, nsIFrame**, int, int, nsILayoutHistoryState*)+ 00200 0D32F5C0 PPC 3CA92C1C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+003E8 0D32F450 PPC 3CA8FEE8 nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell*, nsIPresC ontext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContext*, n sFrameItems&, int, int&)+01238 0D32F130 PPC 3CA9ED14 nsCSSFrameConstructor::ProcessChildren(nsIPresShell* , nsIPresCon text*, nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int, nsTableCrea tor*)+001F4 0D32EF70 PPC 3CA92754 nsCSSFrameConstructor::ConstructFrame(nsIPresShell*, nsIPresCont ext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&)+000F4 0D32EEB0 PPC 3CA92C1C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+003E8 0D32ED40 PPC 3CA8FEE8 nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell*, nsIPresC ontext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContext*, n sFrameItems&, int, int&)+01238 0D32EA20 PPC 3CA9ED14 nsCSSFrameConstructor::ProcessChildren(nsIPresShell* , nsIPresCon text*, nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int, nsTableCrea tor*)+001F4 0D32E860 PPC 3CA92754 nsCSSFrameConstructor::ConstructFrame(nsIPresShell*, nsIPresCont ext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&)+000F4 0D32E7A0 PPC 3CA92A7C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+00248 0D32E630 PPC 3CA92C1C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+003E8 0D32E4C0 PPC 3CA8FEE8 nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell*, nsIPresC ontext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContext*, n sFrameItems&, int, int&)+01238 0D32E1A0 PPC 3CA9ED14 nsCSSFrameConstructor::ProcessChildren(nsIPresShell* , nsIPresCon text*, nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int, nsTableCrea tor*)+001F4 0D32DFE0 PPC 3CA92754 nsCSSFrameConstructor::ConstructFrame(nsIPresShell*, nsIPresCont ext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&)+000F4 0D32DF20 PPC 3CA92C1C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+003E8 0D32DDB0 PPC 3CA8FEE8 nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell*, nsIPresC ontext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContext*, n sFrameItems&, int, int&)+01238 0D32DA90 PPC 3CA9ED14 nsCSSFrameConstructor::ProcessChildren(nsIPresShell* , nsIPresCon text*, nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int, nsTableCrea tor*)+001F4 0D32D8D0 PPC 3CA92754 nsCSSFrameConstructor::ConstructFrame(nsIPresShell*, nsIPresCont ext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&)+000F4 0D32D810 PPC 3CA92C1C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+003E8 0D32D6A0 PPC 3CA8FEE8 nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell*, nsIPresC ontext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContext*, n sFrameItems&, int, int&)+01238 0D32D380 PPC 3CA9ED14 nsCSSFrameConstructor::ProcessChildren(nsIPresShell* , nsIPresCon text*, nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int, nsTableCrea tor*)+001F4 0D32D1C0 PPC 3CA92754 nsCSSFrameConstructor::ConstructFrame(nsIPresShell*, nsIPresCont ext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&)+000F4 0D32D100 PPC 3CA92C1C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+003E8 0D32CF90 PPC 3CA8FEE8 nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell*, nsIPresC ontext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContext*, n sFrameItems&, int, int&)+01238 0D32CC70 PPC 3CA9ED14 nsCSSFrameConstructor::ProcessChildren(nsIPresShell* , nsIPresCon text*, nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int, nsTableCrea tor*)+001F4 0D32CAB0 PPC 3CA92754 nsCSSFrameConstructor::ConstructFrame(nsIPresShell*, nsIPresCont ext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&)+000F4 0D32C9F0 PPC 3CA92C1C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+003E8 0D32C880 PPC 3CA8FEE8 nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell*, nsIPresC ontext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContext*, n sFrameItems&, int, int&)+01238 0D32C560 PPC 3CA9ED14 nsCSSFrameConstructor::ProcessChildren(nsIPresShell* , nsIPresCon text*, nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int, nsTableCrea tor*)+001F4 0D32C3A0 PPC 3CA92754 nsCSSFrameConstructor::ConstructFrame(nsIPresShell*, nsIPresCont ext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&)+000F4 0D32C2E0 PPC 3CA92C1C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+003E8 0D32C170 PPC 3CA8FEE8 nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell*, nsIPresC ontext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContext*, n sFrameItems&, int, int&)+01238 0D32BE50 PPC 3CA9ED14 nsCSSFrameConstructor::ProcessChildren(nsIPresShell* , nsIPresCon text*, nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int, nsTableCrea tor*)+001F4 0D32BC90 PPC 3CA92754 nsCSSFrameConstructor::ConstructFrame(nsIPresShell*, nsIPresCont ext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&)+000F4 0D32BBD0 PPC 3CA92C1C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+003E8 0D32BA60 PPC 3CA8FEE8 nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell*, nsIPresC ontext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContext*, n sFrameItems&, int, int&)+01238 0D32B740 PPC 3CA9ED14 nsCSSFrameConstructor::ProcessChildren(nsIPresShell* , nsIPresCon text*, nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int, nsTableCrea tor*)+001F4 0D32B580 PPC 3CA92754 nsCSSFrameConstructor::ConstructFrame(nsIPresShell*, nsIPresCont ext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&)+000F4 0D32B4C0 PPC 3CA92C1C nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*, nsI PresContext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContex t*, nsFrameItems&, int)+003E8 0D32B350 PPC 3CA8FE18 nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell*, nsIPresC ontext*, nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsIStyleContext*, n sFrameItems&, int, int&)+01168 0D32B030 PPC 3CA922B4 nsCSSFrameConstructor::InitAndRestoreFrame(nsIPresContext*, nsFr ameConstructorState&, nsIContent*, nsIFrame*, nsIStyleContext*, nsIFrame*, nsIFrame*)+0004C 0D32AFE0 PPC 3CB55A7C nsOutlinerColFrame::Init(nsIPresContext*, nsIContent*, nsIFrame* , nsIStyleContext*, nsIFrame*)+0002C 0D32AF90 PPC 3CB5621C nsOutlinerColFrame::InvalidateColumnCache(nsIPresContext*)+00050 0D32AEE0 PPC 3CB51038 nsOutlinerBoxObject::GetOutlinerBody(nsIDOMElement** )+002DC

*** Bug 104273 has been marked as a duplicate of this bug. ***

*** Bug 105309 has been marked as a duplicate of this bug. ***

I see this on win2k. we crash because nsOutlinerBodyFrame::GetOutlinerBody, mContent is null I've got a bullet proofing patch (http://bugzilla.mozilla.org/attachment.cgi?id=53966&action=view) to turn it into an assert (so it can be investigated), but so we don't crash.

I've gotten approval from hyatt to land my bullet proofing patch. once I land, this will turn into an assert for investigation.

sr=sfraser on the patch.

that has r/sr=sfraser,hyatt, checking in when tree opens.

*** Bug 104968 has been marked as a duplicate of this bug. ***

fix checked in, now we just assert.

Adding Trunk keyword for tracking purposes.

So I'm seeing this assert every few characters I type in the URL bar ... if we're not going to fix the problem before mozilla1.0.1, can we at least make this assert a warning so I don't have to dismiss several assertion dialogs just to type something in the URL bar?

seeing the same thing. please #ifdef the assertion to the people that care about this.

i crash again on linux when scroling in To: list in mailcompose. TB38218636Z

Any reason this is still open as a topcrash?

Agree to Peter Trudelle:Any reason this is still open as a topcrash? I don't think this one should be Targeted at 1.0.1... Can we fix it earlier, say, 0.9.9? or even 0.9.8 please?

Are you still seeing it? Is anyone?

The only reason this is still a topcrash is because this crash was a topcrasher with Netscape 6.21. Talkback data still shows a lot of crashes with that Netscape release, but I don't see any incidents with recent Mozilla milestones or daily MozillaTrunk builds. Perhaps we should just mark this worksforme for now...and have it reopened if we see it again any time soon?

I can reproduce with 20020130 build on WinXP.

rubbish@dr.com: Can you please try to reproduce this crash again with a Talkback enabled build and post your crash incident here? I don't see any recent crashes with the nsOutlinerBodyFrame::GetOutlinerBody stack signature in the Talkback database (only N621 crashes and earlier)...so I have a feeling your crash might be showing a different stack signature. I'm marking this worksforme since we aren't crashing anymore...if rubbish's recent crash is indeed the same, we can reopen this. Otherwise we should just log a new bug.