User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2a) Gecko/20020905 Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2a) Gecko/20020905 If I open the URL and try to go back to the previous page, using the keyboard: ALT + left arrow), Mozilla will crash. It doesn't seem to happen if I use the back button. Reproducible: Always Steps to Reproduce: 1. Open the URL. 2. Press ALT + left arrow. Actual Results: Mozilla will crash. Expected Results: The previous page in the session history should be displayed. I have only seen the problem on this specific URL. First seen in build 20020904 for Linux. Also seen in build 20020904 for Windows. No problem in Netscape 7 for Linux. No error message on console. Regarding Talkback, I think I need some education: I have sent a couple of reports using the Quality Feedback Agent - is that the same thing as Talkback, and how do I get a Talkback ID that I can report in this forum?

Please post Talkback ID for these crash via 'mozilla/bin/components/talkback/talkback' on Linux or 'mozilla/bin/components/talkback.exe' on Windows.

The Linux crash has ID TB10468672E. The Windows crash has ID TB10468815Q.

Confirmed 2002090415 on WinNT4: TB10470151G TB10470241E

Confirming on Windows XP, build 2002090604.

Stacktrace from cvs trunk on Linux. Pressed ALT and left arrow on the page.

Seems to be a regression as I don't crash with Linux build 20020904.

Possible checkins: bug 141295. CC'ing people who produced the patch.

fix for bug 141295 was checked in on Sep 5th and, per comment 3, build 20020904 crashes. Culprit checkin rather seems to be bug 129808. CC'ing more people (sorry for the spam), leaving bryner as he gave r= to above fix for bug 141295.

Adding testcase and topcrash+ keywords since people have been able to reproduce this. Also making this a zt4newcrash bug since we know it is a regression (according to Talkback data, this crash was introduced with 9/3 MozillaTrunk builds).

*** Bug 167192 has been marked as a duplicate of this bug. ***

Duped bug 167192 has a recent stack trace and user comments if anyone needs to take a look.

This blocks 1.2a. We need something quickly.

Add null check and some assertions.

Comment on attachment 98236 [details] [diff] [review] fix sr=jst

taking

Comment on attachment 98236 [details] [diff] [review] fix >Index: content/events/src/nsEventStateManager.cpp >=================================================================== > >+ // Docshells need not have a presshell (eg. display:none >+ // iframes, docshells in transition between documents, etc). >+ if (!subPS) { >+ // Just move on to the next child "If this is the case, just ..." >+ continue; >+ } >+ >@@ -1037,12 +1045,14 @@ > nsCOMPtr<nsIPresShell> parentPS; > nsCOMPtr<nsIPresContext> parentPC; > nsCOMPtr<nsIEventStateManager> parentESM; > > parentDS->GetPresShell(getter_AddRefs(parentPS)); >+ NS_ASSERTION(parentPS, "Out presshell exists but the parent's does not?"); s/Out/Our/ r=caillon

Comment on attachment 98236 [details] [diff] [review] fix One more nit: Two of your assertions use "PresShell" and one uses "presshell". Pick one :-)

Comment on attachment 98236 [details] [diff] [review] fix a=roc+moz for trunk

fixed.

Confirming. WFM in build 20020906-22 on Linux.

verified on trunk build 2002122708