Build ID: 2002012503 Steps to reproduce: (1) Open Mailnews. (2) Select a message. (3) In browser, switch themes. (4) Select another mail message. Result: crash. I reproduce this a lot and am usually (always?) in Classic, switching to Modern. But I can't try vice-versa right now because I can't open mailnews (another bug). The not-so-useful stack I get is 0x00000000 nsCOMPtr_base::assign_with_AddRef [d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 74] nsBindingManager::GetBindingImplementation [d:\builds\seamonkey\mozilla\content\xbl\src\nsBindingManager.cpp, line 1181] ntdll.dll + 0x16f5 (0x77f516f5)

Key: +crash Sev: nor -> cri

Confirming on Linux 2002012505 0.9.8 branch. TB2180035M

talkback from case on jan24 with win98 where I crashed after switching themes and selecting a mail message.

this looks like a crash in xbl.

Could this be related to bug 98359?

I'm not sure if this is the same as 98359, that bug is specifically for MAC OSX, no one has mentioned other platforms. I can reproduce this on my winxp using 20020225 build. Note, I also crash when mail is not involved, just launching opening the browser and changing theme from modern to classic will crash when I Exit the app. Not sure if their both the same but here are the stacks from talkback. Here is the talkback stack I get when mail is involved using the original scenario. 0x002f003a nsHTMLLinkElement::SetDocument [d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLLinkElement.cpp, line 108] nsGenericElement::SetDocumentInChildrenOf [d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1408] nsGenericElement::SetDocument [d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1475] nsGenericHTMLElement::SetDocument [d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp, line 1276] nsGenericElement::SetDocumentInChildrenOf [d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1408] nsGenericElement::SetDocument [d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1475] nsGenericHTMLElement::SetDocument [d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp, line 1276] nsDocument::SetScriptGlobalObject [d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1510] DocumentViewerImpl::Close [d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 1393] nsDocShell::SetupNewViewer [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 4144] nsDocShell::Embed [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3536] nsDocShell::CreateContentViewer [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3912] nsDSURIContentListener::DoContent [d:\builds\seamonkey\mozilla\docshell\base\nsDSURIContentListener.cpp, line 108] nsDocumentOpenInfo::DispatchContent [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 362] nsDocumentOpenInfo::OnStartRequest [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 227] nsStreamConverter::OnStartRequest [d:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 947] nsDocumentOpenInfo::OnStartRequest [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 229] nsStreamListenerTee::OnStartRequest [d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 14] nsOnStartRequestEvent0::HandleEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 228] nsStreamListenerEvent0::HandlePLEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 122] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 524] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1072] USER32.dll + 0x3c076 (0x77d7c076) USER32.dll + 0x3c076 (0x77d7c076) netscp6.exe + 0x6600 (0x00406600) kernel32.dll + 0x3bb86 (0x77e9bb86) I get this stack when mail is not involved: 0xf98b5708 nsTemplateRule::GetContent [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsTemplateRule.cpp, line 63] nsStyleContext::Destroy [d:\builds\seamonkey\mozilla\content\base\src\nsStyleContext.cpp, line 1279]

nsbeta1- pending disabling dynamic theme switch.

This should be fixed now. It's exactly the scenario I used when finding bug 129620. *** This bug has been marked as a duplicate of 129620 ***

VERIFIED on Linux. Sending to stephend for verification on the reporter's platform.