We are reproducibly getting the following crash when shutting down trunk Firefox while it's running a Java applet which is part of one of our products. The problem also occurs in Firefox 1.0. jpinsp.dll + 0x6626 (0x6d386626) nsFrameList::DestroyFrames [layout/generic/nsFrameList.cpp, line 129] nsLineBox::DeleteLineList [layout/generic/nsLineBox.cpp, line 318] CanvasFrame::Destroy [layout/generic/nsHTMLFrame.cpp, line 230] nsFrameList::DestroyFrames [layout/generic/nsFrameList.cpp, line 129] ... Example talkback report with complete stack: http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4382548Y If it would be helpful, it may be possible to get access to a system running the applet for the person who is looking at this. Gerv

jpinsp.dll is AFAIK part of the Java plugin (1.4.x) and it looks like the Java plugin itself is crashing. Which JRE Do you use and did you try it with JRE1.5.x ?

Gerv raised this bug for me. I've reproed on various flavours of Sun JRE 1.4.2 and also 1.5.0 and 1.5.0_01. I'm happy to try with another version if that will be useful.

Kyle: are you able to take a look at this, or recommend someone who can? Gerv

Jim, do you have any particular testcase or url to help me recreate the problem? Apparently the talkback data in comment 0 was collected with jre 1.4.2. Did you get any talkback id with jre 1.5?

Kyle, I have the following Talkback IDs that have all occurred on JRE 1.5.0_0x: TB4406273Q TB4541335Y TB4515766W TB4382020Y TB4363301Q TB4363077G TB4359692K I'm currently investigating the possibility of getting you access to one of our systems so that you can repro yourself. Jim

Kyle: did you have any luck with tracking this down? Gerv

Since the crash happens in jvm, I've filed a bug to the Sun Java Plugin team. Haven't heard anything back from them yet.

mass reassign my bugs to Pete Zha.

Kyle: any more news? Gerv

mass reassign to Alfred

We now have an entirely new Java plugin architecture; the chances of this bug still being useful are 0. Gerv