User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.3a) Gecko/20021212 Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.3a) Gecko/20021212 Happens with closing a tab window via Apple-W, also when opening a new tab via control-click. I don't think it's related to <a href="http://bugzilla.mozilla.org/show_bug.cgi?id=186932">186932</a> Reproducible: Sometimes Steps to Reproduce: 1. Go to slashdot 2. Control-click on various links to open tabs 3. Eventually, you'll crash Actual Results: Got angry. Looked at stack trace, which is pasted in the Additional information part. Expected Results: Probably not crashed =) ********** Date/Time: 2003-01-30 13:46:12 -0500 OS Version: 10.2.3 (Build 6G30) Host: Scott-Corscaddens-Computer.local. Command: Mozilla PID: 29682 Exception: EXC_BAD_INSTRUCTION (0x0002) Code[0]: 0x00000002 Code[1]: 0x0426d284 Thread 0 Crashed: #0 0x0426d284 in 0x426d284 #1 0x02df74ec in nsFrame::Invalidate( const(nsIPresContext *, nsRect const &, int)) #2 0x02e7f17c in nsImageFrame::FrameChanged(imgIContainer *, nsIPresContext *) #3 0x02e856f0 in nsImageListener::FrameChanged(imgIContainer *, nsISupports *) #4 0x02ab6e88 in FrameChanged__15imgRequestProxyFP13imgIContainerP14gfxIImageFr #5 0x02ab44d0 in FrameChanged__10imgRequestFP13imgIContainerP11nsISupportsP14gf #6 0x02ac5d1c in imgContainerGIF::Notify(nsITimer *) #7 0x00306fb0 in nsTimerImpl::Fire(void) #8 0x003070dc in handleTimerEvent(TimerEventType *) #9 0x002d3030 in PL_HandleEvent #10 0x002d2e9c in PL_ProcessPendingEvents #11 0x0027ab3c in nsEventQueueImpl::ProcessPendingEvents(void) #12 0x02602e8c in nsMacNSPREventQueueHandler::ProcessPLEventQueue(void) #13 0x02602d30 in nsMacNSPREventQueueHandler::RepeatAction(EventRecord const &) #14 0x01ef6b14 in Repeater::DoRepeaters(EventRecord const &) #15 0x02619ab8 in nsMacMessagePump::DispatchEvent(int, EventRecord *) #16 0x026197f0 in nsMacMessagePump::DoMessagePump(void) #17 0x026190fc in nsAppShell::Run(void) #18 0x025d124c in nsAppShellService::Run(void) #19 0x001a51b4 in main1(int, char **, nsISupports *) #20 0x001a5c0c in main

Stack Trace

-> Layout

-> ImageLib

I'm not sure if this is related, but I'm getting WARNING's from nsFrame::Invalidate with a debug build (pulled today 25/6 NZST) on WinXP. The warning happens if aDamageRect.IsEmpty() is true (and you're running a debug build). http://lxr.mozilla.org/seamonkey/source/layout/html/base/src/nsFrame.cpp#2659

I bet this was fixed somewhere else, but the steps-to-reproduce are too generic to be sure. nsFrame::Invalidate doesn't even exist any more.

(The warning in comment 4 was removed in bug 233292, fwiw)