When going to http://www.detonation.org/cgi-bin/onit/forumclient.cgi?FORUMID=10&FID=56981#NEW with 2001110703 on Win98 Mozilla crashes. Page title is shown and background loaded but before the first real content is shown the crash occures. Did work with 2001110603. It happens on every thread of that forum but not on the same forum with another design and saving that site in IE and loading it locally works. Reproducible: always. Steps to reproduce: load http://www.detonation.org/cgi-bin/onit/forumclient.cgi?FORUMID=10&FID=56981#NEW in browser. TalkbackID: TB37707053X

same stack as bug 108940

Fixing bug 108940 (applied that patch) causes a new crash here: (gdb) frame 0 #0 nsViewManager::GetRootView (this=0x0) at nsViewManager.h:385 385 nsView* GetRootView() const { return mRootView; } #0 nsViewManager::GetRootView (this=0x0) at nsViewManager.h:385 #1 0x41faed34 in nsView::GetPosition (this=0x8abd140, x=0xbfffe6d4, y=0xbfffe6d0) at nsView.cpp:541 #2 0x41fb51ac in nsScrollPortView::AdjustChildWidgets (this=0x8751f20, aScrolling=0x8751f20, aView=0x8abd140, aDx=0, aDy=-2940, scale=0.0666666701) at nsScrollPortView.cpp:383 #3 0x41fb5294 in nsScrollPortView::AdjustChildWidgets (this=0x8751f20, aScrolling=0x8751f20, aView=0x8966c58, aDx=0, aDy=-2940, scale=0.0666666701) at nsScrollPortView.cpp:409 #4 0x41fb5294 in nsScrollPortView::AdjustChildWidgets (this=0x8751f20, aScrolling=0x8751f20, aView=0x87f0f50, aDx=0, aDy=-2940, scale=0.0666666701) at nsScrollPortView.cpp:409 #5 0x41fb57c7 in nsScrollPortView::Scroll (this=0x8751f20, aScrolledView=0x87f0f50, aDx=0, aDy=-196, scale=0.0666666701, aUpdateFlags=0) at nsScrollPortView.cpp:557 #6 0x41fb4f98 in nsScrollPortView::ScrollTo (this=0x8751f20, aX=0, aY=2940, aUpdateFlags=2) at nsScrollPortView.cpp:335 #7 0x41cbb479 in PresShell::ScrollFrameIntoView (this=0x89e3cf0, aFrame=0x8a889a0, aVPercent=0, aHPercent=-1) at nsPresShell.cpp:4199 #8 0x41cb9d7b in PresShell::GoToAnchor (this=0x89e3cf0, aAnchorName=@0xbfffee78) at nsPresShell.cpp:3945 #9 0x4120b829 in HTMLContentSink::ScrollToRef (this=0x8896ea8) at nsHTMLContentSink.cpp:4077 #10 0x4120796c in HTMLContentSink::DidBuildModel (this=0x8896ea8, aQualityLevel=0) at nsHTMLContentSink.cpp:2769 #11 0x40a8bbfe in CNavDTD::DidBuildModel (this=0x892c430, anErrorCode=0, aNotifySink=1, aParser=0x895c928, aSink=0x8896ea8) at CNavDTD.cpp:666 #12 0x40a9e556 in nsParser::DidBuildModel (this=0x895c928, anErrorCode=0) at nsParser.cpp:1390 #13 0x40a9f335 in nsParser::ResumeParse (this=0x895c928, allowIteration=1, aIsFinalChunk=1) at nsParser.cpp:1896 #14 0x40aa0cf5 in nsParser::OnStopRequest (this=0x895c928, request=0x87f2c60, aContext=0x0, status=0) at nsParser.cpp:2544 #15 0x408281d8 in nsDocumentOpenInfo::OnStopRequest (this=0x87cac58, request=0x87f2c60, aCtxt=0x0, aStatus=0) at nsURILoader.cpp:252 #16 0x409065d0 in nsStreamListenerTee::OnStopRequest (this=0x8a06c70, request=0x87f2c60, context=0x0, status=0) at nsStreamListenerTee.cpp:24 #17 0x4094791a in nsHttpChannel::OnStopRequest (this=0x87f2c60, request=0x8961f9c, ctxt=0x0, status=0) at nsHttpChannel.cpp:2322 #18 0x40970662 in nsOnStopRequestEvent::HandleEvent (this=0x8a7c958) at nsRequestObserverProxy.cpp:176 #19 0x408f1517 in nsARequestObserverEvent::HandlePLEvent (plev=0x8a7c958) at nsRequestObserverProxy.cpp:79 #20 0x401fcbab in PL_HandleEvent (self=0x8a7c958) at plevent.c:590 #21 0x401fc9bc in PL_ProcessPendingEvents (self=0x809f348) at plevent.c:520 #22 0x401feba0 in nsEventQueueImpl::ProcessPendingEvents (this=0x809f258) at nsEventQueue.cpp:388 #23 0x40ba1244 in event_processor_callback (data=0x809f258, source=8, condition=GDK_INPUT_READ) at nsAppShell.cpp:184 #24 0x40ba0e2f in our_gdk_io_invoke (source=0x830a8e0, condition=G_IO_IN, data=0x830a8d0) at nsAppShell.cpp:77 #25 0x4049faca in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0 #26 0x404a1186 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0 #27 0x404a1751 in g_main_iterate () from /usr/lib/libglib-1.2.so.0 #28 0x404a18f1 in g_main_run () from /usr/lib/libglib-1.2.so.0 #29 0x403c5c69 in gtk_main () from /usr/lib/libgtk-1.2.so.0 #30 0x40ba18da in nsAppShell::Run (this=0x80a9218) at nsAppShell.cpp:364 #31 0x40b38eac in nsAppShellService::Run (this=0x80aadd8) at nsAppShellService.cpp:302 #32 0x08059e5d in main1 (argc=1, argv=0xbffff6b4, nativeApp=0x0) at nsAppRunner.cpp:1304 #33 0x0805ab7a in main (argc=1, argv=0xbffff6b4) at nsAppRunner.cpp:1630 #34 0x405cb9cb in __libc_start_main (main=0x805a98c <main>, argc=1, argv=0xbffff6b4, init=0x8054148 <_init>, fini=0x8064cfc <_fini>, rtld_fini=0x4000ae60 <_dl_fini>, stack_end=0xbffff6ac) at ../sysdeps/generic/libc-start.c:92

Backed out Robert's changes and this no longer crashes. *** This bug has been marked as a duplicate of 108940 ***