Using commercial builds 2002-01-15-09-trunk/ on NT 4.0 and 2002-01-16-13-trunk/ on linux 2.2 I crash when forwarding a replied email mesg with a web page attached to it. Doesn't seem to crash when I foward an original email mesg (w/web page), reply to a original mesg (W/web page), reply to a replied mesg (w/web page). This could be a layout bug but since it was happening in mail I decided to file in mail first. Steps to reproduce: 1.Login into your imap mail act 2.Go to browser and send a web page via File|Send Page menu item -web pages I used were cnn.com and home.netscape.com 3.Send the mail mesg with the web page to yourself 4.Get the mesg. 5.Reply to that mesg and send it to yourself 6.Get the mesg again 7.Now forward that 'replied mesg w/web page' result: crash expected: to see Forward composition mesg window. I couldn't crash on: -fowarding the original mesg w/web page -replying to the replied mesg Talkback Ids: TB1754843Z - linux TB1754794M, TB1754526E, TB1754683Z, TB1754843Z - windows Stack Trace as follows: FrameManager::GetPrimaryFrameFor [d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 646] PresShell::GetPrimaryFrameFor [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5455] nsCSSFrameConstructor::RecreateFramesForContent [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 11748] nsCSSFrameConstructor::ProcessRestyledFrames [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 9965] PresShell::ReconstructStyleData [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5346] PresShell::StyleSheetDisabledStateChanged [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5387] nsDocument::SetStyleSheetDisabledState [d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1457] nsHTMLEditor::ApplyDocumentOrOverrideStyleSheet [d:\builds\seamonkey\mozilla\editor\libeditor\html\nsHTMLEditor.cpp, line 3480] nsHTMLEditor::ApplyOverrideStyleSheet [d:\builds\seamonkey\mozilla\editor\libeditor\html\nsHTMLEditor.cpp, line 3414] nsEditorShell::PrepareDocumentForEditing [d:\builds\seamonkey\mozilla\editor\composer\src\nsEditorShell.cpp, line 582] nsEditorShell::EndPageLoad [d:\builds\seamonkey\mozilla\editor\composer\src\nsEditorShell.cpp, line 4823] nsEditorShell::OnStateChange [d:\builds\seamonkey\mozilla\editor\composer\src\nsEditorShell.cpp, line 4587] nsDocLoaderImpl::FireOnStateChange [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 1110] nsDocLoaderImpl::doStopDocumentLoad [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 750] nsDocLoaderImpl::DocLoaderIsEmpty [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 647] nsDocLoaderImpl::OnStopRequest [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 578] nsLoadGroup::RemoveRequest [d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp, line 530] nsStreamIOChannel::OnStopRequest [d:\builds\seamonkey\mozilla\netwerk\base\src\nsInputStreamChannel.cpp, line 482] nsOnStopRequestEvent::HandleEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 213] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 524] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1072] I sometimes see this line at the begginig of the stack traces: FrameManager::GetPrimaryFrameFor [d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 646]

Wanted to add I was composing html format. Works fine if you are in text format. Probably needs to go to browser->Editor-core?

Is this a dup of bug 110165?

cc: greer and jpatel. Is this a top crash?

Lisa, It looks like Tracy has been able to consistently crash this one in the smoketests, but it hasn't made the Trunk or M097 topcrash lists. (1640508) - 2002011408: Linux 2.2.12-20smp crash editing home.netscape.com/ja URL: (1777972) - 2002011706: Linux 2.2.12-20smp crash editing jis page URL: (1786538) - 2002011608: Linux 2.4.7-10 test case for #110650 from TB ID 1754277Selected Menu File/Edit Page. Crashed URL: http://www .houstoncellular.com (1788661) - 2002011706: Linux 2.2.12-20smp crash editing cnn.com bug 120631 URL: (1823858) - 2002011806: Linux 2.2.12-20smp crash bug 116052 URL: (1640508) Build: 2002011408 Time: 2002-01-14 twalker@netscape.com crash editing home.netscape.com/ja (1777972) Build: 2002011706 Time: 2002-01-17 twalker@netscape.com crash editing jis page (1786538) Build: 2002011608 Time: 2002-01-17 serge@netscape.com test case for #110650 from TB ID 1754277Selected Menu File/Edit Pag e. Crashed (1788661) Build: 2002011706 Time: 2002-01-17 twalker@netscape.com crash editing cnn.com bug 120631 (1823858) Build: 2002011806 Time: 2002-01-18 twalker@netscape.com crash bug 116052

Jean-Francois, could you reassign if necessary?

looking at it...

2002-01-23-06 win98 This crash can be easily reproduced by following Gary's steps above. This happens only on an imap account. I was able to forward the replied message from a pop account as default.

Possible dupe of bug 117141?

*** This bug has been marked as a duplicate of 117141 ***

vrfyd based on stack trace