From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.9) Gecko/20020311 BuildID: 2002031104 This page crashes reproducibly if I scroll down to the bottom and back up either by rolling the mouse wheel or dragging the scrollbar. I have not tried other ways to scroll it. It sometimes crashes during the scroll down, but always by the scroll back up. Reproducible: Always Steps to Reproduce: 1. Go to the URL 2. Scroll down to the bottom using mouse 3. Scroll up towards the top using mouse Actual Results: The browser crashed, triggering talkback and W2K's crash catcher. I don't know where W2K logs the crash though. Expected Results: Scrolled back up to the top of the document without crashing. The Talkback crash IDs are: TB5189049Z TB5188897H TB5188453M TB5188415K TB5188324X Saving the page to disk with "Save Page As..." before scrolling, then loading the page into Mozilla and scrolling up and down did not reproduce the bug, the trigger must be something not saved by that command.

Unable to reproduce on XP, build 2002041408. WFM. Likely fixed. Stephen: Can you pull TB5189049Z ?

Unable to reproduce on (probably) same build as reported: 0.9.9 - Mozilla/5.0 (Windows; U; Win95; en-US; rv:0.9.9) Gecko/20020311 but (slightly) different OS...

Verified -- 0.9.9 (2002031104) / Win2k. Worked exactly as reporter described it. TB5194330W

nsImageWin::DrawTile [d:\builds\seamonkey\mozilla\gfx\src\windows\nsImageWin.cpp, line 799] nsRenderingContextImpl::DrawTile [d:\builds\seamonkey\mozilla\gfx\src\nsRenderingContextImpl.cpp, line 968] nsCSSRendering::PaintBackgroundWithSC [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSRendering.cpp, line 3123] nsCSSRendering::PaintBackground [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSRendering.cpp, line 2586] nsTableCellFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 442] nsTableRowFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 661] nsTableRowFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 604] nsTableRowGroupFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp, line 295] nsTableRowFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 604] nsContainerFrame::PaintChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 256] nsContainerFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 197] nsTableFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1460] nsTableFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1502] nsContainerFrame::PaintChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 256] nsTableOuterFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 376] nsContainerFrame::PaintChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 256] nsBlockFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5520] nsBlockFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5392] nsContainerFrame::PaintChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 256] nsBlockFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5520] nsBlockFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5392] nsContainerFrame::PaintChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 256] nsContainerFrame::PaintChildren [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 197] nsHTMLContainerFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp, line 135] CanvasFrame::Paint [d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 390] PresShell::Paint [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5711] nsView::Paint [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 280] nsViewManager::RenderDisplayListElement [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1175] nsViewManager::RenderViews [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1124] nsViewManager::Refresh [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 719] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1709] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 891] nsWindow::OnPaint [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4510] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3399] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131] USER32.DLL + 0x1b60 (0x77e11b60) USER32.DLL + 0x2f29 (0x77e12f29) USER32.DLL + 0x2f4f (0x77e12f4f) ntdll.dll + 0x2032f (0x77fa032f) nsScrollPortView::Scroll [d:\builds\seamonkey\mozilla\view\src\nsScrollPortView.cpp, line 539] nsScrollPortView::ScrollTo [d:\builds\seamonkey\mozilla\view\src\nsScrollPortView.cpp, line 316] nsGfxScrollFrameInner::ScrollbarChanged [d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 1472] nsGfxScrollFrameInner::AttributeChanged [d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 917] nsDocument::AttributeChanged [d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1998] nsHTMLDocument::AttributeChanged [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line 1461] nsXULElement::SetAttr [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2737] nsXULElement::SetAttr [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2757] nsSliderFrame::SetCurrentPosition [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSliderFrame.cpp, line 894] nsSliderFrame::HandleEvent [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSliderFrame.cpp, line 640] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6021] PresShell::HandleEvent [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5927] nsViewManager::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2043] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1863] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 886] nsWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4713] ChildWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4963] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3630] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131] USER32.DLL + 0x1b60 (0x77e11b60)

Same stack as in bug 128282. (The fix didn't make it into the 0.9.9 release.) Resolving as dup. *** This bug has been marked as a duplicate of 128282 ***

v