I think (though of course I'm not entirely sure) that this is fallout from bug 244366; I only started crashing with today's build; usually when loading large pages (such as Bonsai checkins) and doing something while it's doing that (i.e. moving the mouse). I still don't have the steps to reproduce yet, sorry. 0x00000000 nsEventStateManager::DispatchMouseEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 2542] nsEventStateManager::GenerateMouseEnterExit [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 2618] nsEventStateManager::PreHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 474] PresShell::HandleEventInternal [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5902] PresShell::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5761] nsViewManager::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2424] nsViewManager::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2151] HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174] nsWindow::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1103] nsWindow::DispatchMouseEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 5402] ChildWindow::DispatchMouseEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 5653] nsWindow::WindowProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1389] USER32.dll + 0x8709 (0x77d48709) USER32.dll + 0x87eb (0x77d487eb) USER32.dll + 0x89a5 (0x77d489a5) USER32.dll + 0x89e8 (0x77d489e8) nsAppShell::Run [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp, line 159] nsAppStartup::Run [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp, line 208] main [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1811] WinMain [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1839] kernel32.dll + 0x16d4f (0x7c816d4f)

*** Bug 279204 has been marked as a duplicate of this bug. ***

dupe of bug 279238 ? That one has slightly more details

Yes, but this one is in the right product/component, has reliable steps to reproduce (which aren't in the bug because they involve a private page), and is pretty definitely a regression from bug 244366. Marking blocking the other for now.

Robert, see bug 244366 comment 14 for the background on this change... Changing this is definitely the right thing to do, and seems to fix this crash.

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=3221984#id TB3221984H, TB3221865K, TB3221839Y Steps to reproduce: 1. load http://www.bzga.de/ 2. click in the menus to the left, may take 3 to 6 minuts to crash. I first crashed after a long browsing session, had lots of tabs open, when I loaded that page, and wanted to read more of an article, and clicked 'gesamten Text lesen...' (read full text..), and instantly crashed. I reopened the browser, went directly to that page bzga.de, got redirected, retried reading the article, reading some others, reloading, then concentrated on clicking the menu to the left, and succeeded in another crash. Installed nightly, produced three more crashs, now with talkback.

better steps to repeat: 1. load http://www.bzga.de/ (JS must be enabled to get redirected) 2. in the top menu click 2nd link to the right, 'English', to crash. 3. if it didn´t crash, click on Mozilla´s Back button to crash. direct link to the English site, but I didn´t try, suspect you must click the original button: http://www.bzga.de/jumpto.php3?uid=41972a04a048bf686a52fd244708cd00&id=home http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=url&match=contains&searchfor=bzga&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid TB3222651W, TB3222606E crashed twice 'in nsEventStateManager::DispatchMouseEvent', when after loading the page I switched to 'english', and when I pressed back. TB3222461E, TB3221984H crashed twice in 'nsEventStateManager::GenerateMouseEnterExit' TB3221865K, TB3221839Y crashed twice in '0x00000013 5a3a859f', no other useful info

Yeah, this patch seems to fix the steps in comment 6.

Patch works for me too (Firefox/BeOS). It always used to crash on the first click of the 'Sign In' button on mail.lycos.co.uk before applying the patch.

Checked in.

*** Bug 279458 has been marked as a duplicate of this bug. ***

*** Bug 279238 has been marked as a duplicate of this bug. ***

Verified FIXED for me using build 2005-01-24-05 on Windows XP. Thanks Boris!

Adding topcrash info for tracking. This was a regression on the Trunk starting on 1/20 and has gone away since this patch was checked in 1/23.

Adding [@ nsDOMEvent::GetTargetFromFrame] from duped bug 279458 for future reference.

*** Bug 279752 has been marked as a duplicate of this bug. ***

*** Bug 280490 has been marked as a duplicate of this bug. ***