I'm seeing a crash on this afternoon's NT 4.0 debug build when I reply to email using HTML mail compose: The crash has the following call stack: nsCSSFrameConstructor::GetFloaterContainingBlock(nsIPresContext * 0x042b1990, nsIFrame * 0x04501eb0) line 5181 + 15 bytes nsCSSFrameConstructor::ContentChanged(nsCSSFrameConstructor * const 0x042b2830, nsIPresContext * 0x042b1990, nsIContent * 0x04501c7c, nsISupports * 0x00000000) line 6695 + 16 bytes StyleSetImpl::ContentChanged(StyleSetImpl * const 0x042b2790, nsIPresContext * 0x042b1990, nsIContent * 0x04501c7c, nsISupports * 0x00000000) line 974 PresShell::ContentChanged(PresShell * const 0x042b28c8, nsIDocument * 0x03571ce0, nsIContent * 0x04501c7c, nsISupports * 0x00000000) line 2007 + 46 bytes nsXULDocument::ContentChanged(nsXULDocument * const 0x03571ce0, nsIContent * 0x04501c7c, nsISupports * 0x00000000) line 1115 nsGenericDOMDataNode::SetText(unsigned short * 0x0450f790, int 18, int 1) line 992 nsTextNode::SetText(nsTextNode * const 0x04501c80, unsigned short * 0x0450f790, int 18, int 1) line 73 + 26 bytes nsGfxTextControlFrame::SetTextControlFrameState(const nsString & {...}) line 915 nsGfxTextControlFrame::SetProperty(nsGfxTextControlFrame * const 0x044dd95c, nsIPresContext * 0x042b1990, nsIAtom * 0x01508fa0, const nsString & {...}) line 940 nsHTMLInputElement::SetValue(nsHTMLInputElement * const 0x04389bb0, const nsString & {...}) line 403 SetHTMLInputElementProperty(JSContext * 0x03a472d0, JSObject * 0x03d51ba8, long -35, long * 0x0012e31c) line 710 + 22 bytes js_SetProperty(JSContext * 0x03a472d0, JSObject * 0x03d51ba8, long 20692672, long * 0x0012e31c) line 2067 + 137 bytes js_Interpret(JSContext * 0x03a472d0, long * 0x0012e4b0) line 2211 + 955 bytes js_Invoke(JSContext * 0x03a472d0, unsigned int 3, unsigned int 0) line 689 + 13 bytes js_Interpret(JSContext * 0x03a472d0, long * 0x0012ecbc) line 2244 + 15 bytes js_Invoke(JSContext * 0x03a472d0, unsigned int 1, unsigned int 0) line 689 + 13 bytes js_Interpret(JSContext * 0x03a472d0, long * 0x0012f404) line 2244 + 15 bytes closure_call(JSContext * 0x03a472d0, JSObject * 0x03d51160, unsigned int 0, long * 0x03d5c0b8, long * 0x0012f4f0) line 660 + 13 bytes js_Call(JSContext * 0x03a472d0, JSObject * 0x03d51160, unsigned int 0, long * 0x03d5c0b8, long * 0x0012f4f0) line 2518 + 26 bytes js_Invoke(JSContext * 0x03a472d0, unsigned int 0, unsigned int 0) line 673 + 26 bytes nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x0454ca90, nsXPCWrappedJS * 0x0454c300, unsigned short 3, const nsXPTMethodInfo * 0x013d0f50, nsXPTCMiniVariant * 0x0012f778) line 716 + 22 bytes nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x0454c300, unsigned short 3, const nsXPTMethodInfo * 0x013d0f50, nsXPTCMiniVariant * 0x0012f778) line 296 PrepareAndDispatch(nsXPTCStubBase * 0x0454c300, unsigned int 3, unsigned int * 0x0012f82c, unsigned int * 0x0012f818) line 100 + 31 bytes SharedStub() line 125

I updated to the tip and am no longer seeing this crash. Marking worksforme...

Marking as verified fix in the Nov 15th build.