From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.8+) Gecko/20020128 BuildID: 20020128 Mozilla crahes when the button "expandAll();" is pressed on URL. Reproducible: Always Steps to Reproduce: 1. Go to http://webfx.eae.net/dhtml/xtree/demo.html 2. Press button "expandAll();" and see Mozilla crash.

confirming on Win2k using build 2002012903. Talkback ID: TB2335424M. Stephen, can you retreive Talkback data please ?

crashes the branch in CopyChars1To2 () from /usr/local/mozilla/libxpcom.so on linux. Trunk doesn't crash - but it doesn't lay the page out correct either - the folders top left are missing and clicking the button has no effect what so ever. Stack on 0.9.8 2002013003 linux: #0 0x40190ec0 in CopyChars1To2 () from /usr/local/mozilla/libxpcom.so #1 0x4019193e in nsStr::StrAppend () from /usr/local/mozilla/libxpcom.so #2 0x40191881 in nsStr::StrAssign () from /usr/local/mozilla/libxpcom.so #3 0x401953f1 in nsString::nsString () from /usr/local/mozilla/libxpcom.so #4 0x4002b203 in nsFont::nsFont () from /usr/local/mozilla/libgkgfx.so #5 0x40ed62af in NSGetModule () from /usr/local/mozilla/components/libgfx_gtk.so #6 0x4002ad89 in nsFontCache::GetMetricsFor () from /usr/local/mozilla/libgkgfx.so #7 0x40029eca in DeviceContextImpl::GetMetricsFor () from /usr/local/mozilla/libgkgfx.so #8 0x416eb6ca in NSGetModule () from /usr/local/mozilla/components/libgklayout.so ....(repeats).... #51 0x41712adb in NSGetModule () from /usr/local/mozilla/components/libgklayout.so #52 0x401623c7 in PL_HandleEvent () from /usr/local/mozilla/libxpcom.so #53 0x401622e3 in PL_ProcessPendingEvents () from /usr/local/mozilla/libxpcom.so #54 0x40163218 in nsEventQueueImpl::ProcessPendingEvents () from /usr/local/mozilla/libxpcom.so #55 0x40851243 in NSGetModule () from /usr/local/mozilla/components/libwidget_gtk.so #56 0x40850fbd in NSGetModule () from /usr/local/mozilla/components/libwidget_gtk.so #57 0x40388a7a in g_io_unix_dispatch (source_data=0x825d988, current_time=0xbfffe9dc, user_data=0x825d960) at giounix.c:137 #58 0x4038a055 in g_main_dispatch (dispatch_time=0xbfffe9dc) at gmain.c:656 #59 0x4038a659 in g_main_iterate (block=1, dispatch=1) at gmain.c:877 #60 0x4038a7e8 in g_main_run (loop=0x825da00) at gmain.c:935 #61 0x4029e65b in gtk_main () at gtkmain.c:524 #62 0x408516d4 in NSGetModule () from /usr/local/mozilla/components/libwidget_gtk.so #63 0x4083132e in fullsoft_copyright () from /usr/local/mozilla/components/libnsappshell.so #64 0x0804fdf9 in main1 () #65 0x08050647 in main () #66 0x404e7627 in __libc_start_main (main=0x8050518 <main>, argc=1, ubp_av=0xbfffebb4, init=0x804bf58 <_init>, fini=0x8051aa0 <_fini>, rtld_fini=0x4000dcc4 <_dl_fini>, stack_end=0xbfffebac) at ../sysdeps/generic/libc-start.c:129 (gdb) Resolving as dup of topcrash bug 105619 *** This bug has been marked as a duplicate of 105619 ***

(correction: stack was from 2002013010 0.9.8 branch)

v