http://webfx.eae.net/dhtml/xtree/demo.html Reproducable: - click toggle() - click expand() - click collapse() - click expandAll() (notice color change) - click collapseAll() - click expandAll() again....mozilla crashes

Build ID 2002021108

I've duplicated this bug on a Win2000 system using Mozilla Build #2002021203. Also, I've filed a Talkback incident report (ID:TB2908825Z)

confirming crash. Setting the priority to P3

Confirming, and reassigning to Style System. We crash due to the style system giving us a bogus nsStyleFont struct in nsTextFrame::TextStyle::TextStyle(). nsAString::IsEmpty() line 140 + 15 bytes nsAString::do_AssignFromReadable(const nsAString & {...}) line 288 + 8 bytes nsAString::AssignFromReadable(const nsAString & {...}) line 239 nsAString::Assign(const nsAString & {...}) line 263 + 19 bytes nsString::operator=(const nsString & {...}) line 281 + 19 bytes nsFont::operator=(const nsFont & {...}) line 104 nsFontMetricsWin::Init(nsFontMetricsWin * const 0x03ee2590, const nsFont & {...}, nsIAtom * 0x029d2200, nsIDeviceContext * 0x03509740) line 469 nsFontCache::GetMetricsFor(nsFontCache * const 0x037631c0, const nsFont & {...}, nsIAtom * 0x029d2200, nsIFontMetrics * & 0x00000000) line 670 + 27 bytes DeviceContextImpl::GetMetricsFor(DeviceContextImpl * const 0x03509740, const nsFont & {...}, nsIAtom * 0x029d2200, nsIFontMetrics * & 0x00000000) line 303 nsTextFrame::TextStyle::TextStyle(nsIPresContext * 0x03b0ed90, nsIRenderingContext & {...}, nsIStyleContext * 0x02f83694) line 553

Same as bug 105619? Might this be easier to debug...?

I'm not seeing crashes but I'm seeing a good bit of incorrect display.

OK, I got it to crash this time.

This is fixed by the patch on bug 105619. *** This bug has been marked as a duplicate of 105619 ***

Yep, fixed!