I'm getting an abnormal program termination with the following call stack when I choose TV guide from the book mark list: bookmarks>Entertainment>TV Guide. NTDLL! 77f7629c() js_Lock(JSThinLock * 0xdddddef1, long 0xdddddddd) line 613 + 40 bytes js_AtomizeString(JSContext * 0x01bc48c0, JSString * 0x0012e8b8, unsigned int 0x00000002) line 515 + 24 bytes js_AtomizeChars(JSContext * 0x01bc48c0, const unsigned short * 0x0012e9dc, unsigned int 0x00000010, unsigned int 0x00000000) line 605 + 19 bytes LookupUCProperty(JSContext * 0x01bc48c0, JSObject * 0x00cc9068, const unsigned short * 0x0012e9dc, unsigned int 0x00000010, JSObject * * 0x0012e90c, JSProperty * * 0x0012e904) line 2040 + 48 bytes JS_LookupUCProperty(JSContext * 0x01bc48c0, JSObject * 0x00cc9068, const unsigned short * 0x0012e9dc, unsigned int 0x00000010, long * 0x0012e970) line 2302 + 29 bytes GlobalWindowImpl::GetObjectProperty(GlobalWindowImpl * const 0x01c2e994, const unsigned short * 0x0012e9dc, nsISupports * * 0x0012ea64) line 2606 + 39 bytes nsContentTreeOwner::SetStatus(nsContentTreeOwner * const 0x02ffd8bc, unsigned int 0x00000003, const unsigned short * 0x0012eb08) line 212 nsWebShell::OnOverLink(nsWebShell * const 0x02ffbbb4, nsIContent * 0x031dce90, const unsigned short * 0x0012eb08, const unsigned short * 0x0012ecb0) line 885 nsGenericElement::TriggerLink(nsIPresContext * 0x033bc490, nsLinkVerb eLinkVerb_Replace, nsIURI * 0x02f974d0, const nsString & {...}, const nsString & {...}, int 0x00000000) line 2452 nsGenericHTMLElement::HandleDOMEventForAnchors(nsIContent * 0x031dce90, nsIPresContext * 0x033bc490, nsEvent * 0x0012f118, nsIDOMEvent * * 0x0012f050, unsigned int 0x00000002, nsEventStatus * 0x0012f15c) line 1202 + 40 bytes nsHTMLAnchorElement::HandleDOMEvent(nsHTMLAnchorElement * const 0x031dce90, nsIPresContext * 0x033bc490, nsEvent * 0x0012f118, nsIDOMEvent * * 0x0012f050, unsigned int 0x00000002, nsEventStatus * 0x0012f15c) line 405 nsGenericElement::HandleDOMEvent(nsIPresContext * 0x033bc490, nsEvent * 0x0012f118, nsIDOMEvent * * 0x0012f050, unsigned int 0x00000001, nsEventStatus * 0x0012f15c) line 1456 + 45 bytes nsHTMLImageElement::HandleDOMEvent(nsHTMLImageElement * const 0x031d93ec, nsIPresContext * 0x033bc490, nsEvent * 0x0012f118, nsIDOMEvent * * 0x00000000, unsigned int 0x00000001, nsEventStatus * 0x0012f15c) line 590 nsEventStateManager::GenerateMouseEnterExit(nsIPresContext * 0x033bc490, nsGUIEvent * 0x0012f894) line 1501 nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x031b8c08, nsIPresContext * 0x033bc490, nsEvent * 0x0012f894, nsIFrame * 0x02866620, nsEventStatus * 0x0012f784, nsIView * 0x03212690) line 306 PresShell::HandleEventInternal(nsEvent * 0x0012f894, nsIView * 0x03212690, nsEventStatus * 0x0012f784) line 4225 + 43 bytes PresShell::HandleEvent(PresShell * const 0x033eed14, nsIView * 0x03212690, nsGUIEvent * 0x0012f894, nsEventStatus * 0x0012f784, int 0x00000000, int & 0x00000001) line 4166 + 23 bytes nsView::HandleEvent(nsView * const 0x03212690, nsGUIEvent * 0x0012f894, unsigned int 0x00000008, nsEventStatus * 0x0012f784, int 0x00000000, int & 0x00000001) line 379 nsView::HandleEvent(nsView * const 0x03214190, nsGUIEvent * 0x0012f894, unsigned int 0x00000008, nsEventStatus * 0x0012f784, int 0x00000000, int & 0x00000001) line 352 nsView::HandleEvent(nsView * const 0x033ee650, nsGUIEvent * 0x0012f894, unsigned int 0x0000001c, nsEventStatus * 0x0012f784, int 0x00000001, int & 0x00000001) line 352 nsViewManager2::DispatchEvent(nsViewManager2 * const 0x033ec130, nsGUIEvent * 0x0012f894, nsEventStatus * 0x0012f784) line 1429 HandleEvent(nsGUIEvent * 0x0012f894) line 68 nsWindow::DispatchEvent(nsWindow * const 0x03213294, nsGUIEvent * 0x0012f894, nsEventStatus & nsEventStatus_eIgnore) line 614 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f894) line 635 nsWindow::DispatchMouseEvent(unsigned int 0x0000012c, nsPoint * 0x00000000) line 3811 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 0x0000012c, nsPoint * 0x00000000) line 4021 nsWindow::ProcessMessage(unsigned int 0x00000200, unsigned int 0x00000000, long 0x005d0010, long * 0x0012fc10) line 2870 + 24 bytes nsWindow::WindowProc(HWND__ * 0x0a5703f0, unsigned int 0x00000200, unsigned int 0x00000000, long 0x005d0010) line 883 + 27 bytes USER32! 77e71820() 005d0010()

This stack trace here reminds me of bug 51714, especially this comment: ------- Additional Comments From jpatel@netscape.com 2000-09-11 18:18 ------- Many ntdll.dll and kernel32.dll crashes from the talkback data show this as the location of the crash in their stack traces. here are the common lines from one of many similar stack traces: Incident ID 16977682 KERNEL32.DLL + 0xbb07 (0xbff6bb07) js_Lock [d:\builds\seamonkey\mozilla\js\src\jslock.c, line 603] js_AtomizeString [d:\builds\seamonkey\mozilla\js\src\jsatom.c, line 516] js_AtomizeChars [d:\builds\seamonkey\mozilla\js\src\jsatom.c, line 606] LookupUCProperty [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 2042] JS_LookupUCProperty [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 2304] GlobalWindowImpl::GetObjectProperty [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 2559] nsContentTreeOwner::SetStatus [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsContentTreeOwner.cpp, line 212] -------------------------------------------------------------------------- cc'ing people from bug 51714 - is the current bug a duplicate ?

Looks like a dup, but get a load of those nearly 0xddddd* addresses. Phil, can you reproduce at will? How about under a debugger? /be

While trying to duplicate this under gdb, Linux itself crashed! Steps: I was accessing TVGuide through bookmarks>Entertainment>TV Guide, exactly as pnunn described. Will keep trying -

I attached the debug patch I said I'd write. I haven't got it to fire yet. I can't yet reproduce the bug at all. When I go to that page no dialog pops up. Ideas?

phil, can you dup bug 51714 and any others to this bug, which has the best info, and mark this one with all the keywords from the other(s)? Thanks, /be

jband, maybe it's not a DOM JSContext that's destroyed but not popped: how about a totally gross extern "C" hacked hook called from JS_DestroyContext? /be

brendan, be can't link that on Windows without build hacking.

Pam, Is this only happening on the commercial build by chance? I did as Phil suggested and ran a default profile and chose from the menu, but maybe this site is sensitive to user agent or something? I notice that the bookmark is taking me through a redirect.

*** Bug 51714 has been marked as a duplicate of this bug. ***

*** Bug 50600 has been marked as a duplicate of this bug. ***

Adding keywords from duped bugs -

brendan, Well I could add a context destuction debug hook in jsdbgapi.h and do this scanning in the context service in xpc - where the deque is easier to scan. Still, I haven't been able to reproduce anything interesting.

*** Bug 52677 has been marked as a duplicate of this bug. ***

updating summary with [@ js_Lock] for topcrash tracking purposes.

See 53445 for what looks like a very similar stack trace.

*** Bug 53438 has been marked as a duplicate of this bug. ***

*** Bug 52852 has been marked as a duplicate of this bug. ***

Pam, Is this still reproducable on your machine? If so, can I come see it sometime today? I've *never* managed to get this to crash for me.

I'm seeing this in my debug build from 2000-09-21-20, except I crash with the stack from bug 52852, in js_ContextIterator.

Jeff, can you try jband's patch (in this bug) if you're building Mozilla yourself? We need to catch the bad JS_DestroyContext in the act. I'll go read code. This has to be "obvious" amid all the kungFuDeathGrips and other nasty unwind-protects that defer (or don't defer) context destruction while window close code is happening. /be

This really isn't rogerl's bug. Dan, you wanna take it? /be

In today's talkback data, a new stack signature showed up in the topcrash list: gc_find_flags. The stack trace(s) for most of those crashes look like this at the top: gc_find_flags [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 215] js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 721] gc_root_marker [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 850] JS_HashTableEnumerateEntries [d:\builds\seamonkey\mozilla\js\src\jshash.c, line 365] js_GC [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 1060] or like this: gc_find_flags [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 215] js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 721] js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 750] js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 750] js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 750] js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 750] js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 750] js_Mark [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 3068] Is this crash related to this bug? Just want to make sure before i added any more info. Thanks.

jpatel: not clear that the js_MarkGCThing crash (so far, haven't seen it die in gc_find_flags, but the signature to look for is js_MarkGCThing at or one below the top frame) is the same as this bug. Let's track it under bug 53123, which I updated recently. /be

Pam, Can you apply the patch in bug 53123 and see if the problem goes away? I've never reproduced this on my machine. We looked at what might be special about Pam's setup. For one thing she gets a modal "Netscape can't find the Plugin Downloader Plugin..." dialog when she enters the tvguide site. I discovered that this can be triggered by deleting the plugins/npnul32.dll file ahead of time. Given that the JS_PushArguments used in nsCommonDialogs::DoDialog has a case of a multi char arguement this could clearly be the culprit.

The most recent js_Lock crash in the talkback reports was on build 2000-09-19-09. None on the 20th or 21st.

What changed around the 19th? Any possible fixes show up in bonsai? /be

Nothing obvious. Only thing I noticed was hyatt's checkin comment: "Fix for several XBL event regressions, trashing memory and crashers, sr=brendan,ben, a=brendan" (2000-09-20, 00:16-00:21)

BTW, some of the dups (such as the js_MarkGCThing crash) are still showing up on talkback reports.

dbaron: the js_MarkGCThing crash is not a dup, see my comments dated 2000-09-21 14:36 -- that was bug 53123, now fixed (I checked into branch and trunk late-ish Friday night). /be

I see the trace of jpatel@netscape.com from 21.09.2000 at http://www.mindspring.com/~bobcarley/tc.html 1. Select All 2. Submit

Bernd: if you see the crash that i mentioned on 9/21, please go to bug 53123 and put your comments there. it is a separate bug. thanks.

borrowing OS:All from a duped bug (dupes include w98, wnt and linux).

jband surmises that this may have been fixed with one or both of the fixes to 53123 - we should check to see whether this occurs in nsbeta3 talkback, as it seems tricky to reproduce. Putting it on rtm radar for reproduction attempts or comparison with talkback reports.

dbaron correlated it with a fix around the 19th or 20th, and fingered a hyatt XBL landing. Have there been any talkbacks since then, up till the 53123 patch went in? I myself cannot connect 53123 to this bug's skidmarks, via thought experiments. /be

js_Lock stopped showing after 09/19. The following URL shows the top 40 crashers reported in last 10 days using any of the last 10 days build. js_Lock crash last must have happened on 09/18 and It was the top crash then. Since, it didn't happen in the last 10 days it is out of the list of top crashers. http://beckett.mcom.com/talkback/rankoutput.html

Since this topcrash went away after the 19th, I think it's worth some bonsai archeology. Hyatt's XBL changes do not seem likely to cause a JSContext to be destroyed but not popped off the per-thread context stack. OTOH, danm's change: http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&su bdir=mozilla/xpfe/appshell/src&command=DIFF_FRAMESET&file=nsXULWindow.cpp&rev1=1 .51&rev2=1.52&root=/cvsroot with log message "skip parent window activation (bug 22658) on close if parent is HiddenWindow. bug 51619. r=hyatt" does seem like a candidate. Danm, can you say more? Was the bug or bugs fixed by that checkin Windows only? Are there open bugs on file about the bogus use of the hidden window as a parent for bastard-child dialogs? And can you see any way in which the http://www.tvguide.com site would run afoul of the bug you fixed? Reassigning to you, rogerl is not "it" and never was. Phil, pnunn: please let us know if you can reproduce this bug's crash (including the freed JSContext). I think we can close this if it doesn't reproduce. I would love to prove that it was a dup of the bug(s) danm fixed. Thanks, /be

I pulled a new fresh vanilla moz tree and didn't see the crash. I kept the old crasher tree around and am attempting to update it now. I'll post what I find in the bug. My bet is other checkins fixed it. -p

Going to www.tvguide.com doesn't crash for me with a build from today (I'm not using a bookmark), independent of whether my "parent window activation" patch is in or backed out. So I don't think that was it. Still, I'll be happy to hold onto the dead bug until its demise is official. As long as no one reopens it.

I updated my tree which was crashing before and now I don't get the crash at tvguide.com. I think we can close this bug. Dan, would you like to have the honor? -P

Woo hoo!

I used to crash by clicking on the My Netscape icon in home.netscape.com on Linux (one of the dups). It works fine in today's build. TV Guide also works. Marking verified.

Moving all the Works For Me bugs to talkback user account for future reference.

We are gathering all the Resolved and WFM bugs which are happened to be topcrash bugs and assigning it to talkback. I am marking all of them as RESOLVED WFM.

Marking Verified -

Reopening as a topcrash on N620 for Windows only. Count Offset Real Signature [ 35 js_Lock 40aaff7a - js_Lock ] Crash date range: 2001-11-04 to 2001-11-15 Count Platform List 14 Windows 98 4.10 build 67766446 13 Windows 98 4.90 build 73010104 7 Windows 98 4.10 build 67766222 1 Windows NT 5.0 build 2195 No of Unique Users 35 Stack trace(Frame) js_Lock [d:\builds\seamonkey\mozilla\js\src\jslock.c line 938] js_AtomizeString [d:\builds\seamonkey\mozilla\js\src\jsatom.c line 565] js_AtomizeChars [d:\builds\seamonkey\mozilla\js\src\jsatom.c line 655] LookupUCProperty [d:\builds\seamonkey\mozilla\js\src\jsapi.c line 2158] JS_LookupUCProperty [d:\builds\seamonkey\mozilla\js\src\jsapi.c line 2427] GlobalWindowImpl::GetObjectProperty [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp line 2872] nsContentTreeOwner::SetStatus [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsContentTreeOwner.cpp line 327] GlobalWindowImpl::SetStatus [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp line 1090] GlobalWindowImpl::SetNewDocument [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp line 344] DocumentViewerImpl::Init [d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp line 931] nsDocShell::SetupNewViewer [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp line 4148] nsWebShell::SetupNewViewer [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp line 306] nsDocShell::Embed [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp line 3586] nsWebShell::Embed [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp line 326] nsDocShell::CreateContentViewer [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp line 3880] nsDSURIContentListener::DoContent [d:\builds\seamonkey\mozilla\docshell\base\nsDSURIContentListener.cpp line 122] nsDocumentOpenInfo::DispatchContent [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp line 358] nsDocumentOpenInfo::OnStartRequest [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp line 226] nsHttpChannel::ProcessNormal [d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp line 467] nsHttpChannel::ProcessResponse [d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp line 437] nsHttpChannel::OnStartRequest [d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp line 2145] nsOnStartRequestEvent::HandleEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp line 111] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 591] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 1072] 0x778b0c24 (38067497) Comments: downloading java2 1.3. After that entering a webside of a bank (37987976) Comments: I WAS ATTEMPTING TO WRITE AN E-MAIL. (37966012) Comments: surfing the net (37888163) Comments: trying to access a website for a game (37824708) URL: geocities.com.mudear22.index.html (37824708) Comments: renaming placeholder page to index.html (37823548) URL: www.jt.lt (37823548) Comments: Browser do not show the graphs in the right page side.Try to install Java Plug-In. (37807960) URL: games.yahoo.com (37782985) Comments: could not initialize installation (CRC)this function is valid in win32 mode (37692450) Comments: Downloading ICQ (37689187) URL: http:/downloads.cnet.com (37689187) Comments: i went to look at sub article "internet tools"--software choice for the day. Count Offset Real Signature [ 14 js_Lock d9732305 - js_Lock ] [ 5 js_Lock df813065 - js_Lock ] Count Platform List 14 Windows 98 4.10 build 67766446 5 Windows 98 4.90 build 73010104 No of Unique Users 15 (38079436) Comments: Opening my mail on aol 5 (37904760) Comments: comes up with error feedback immediately after windows 98 2nd addition comes up at power turn on (37842486) Comments: starting net 6.2 (37838867) Comments: NETSCP6 caused an invalid page fault inmodule JS3250.DLL at 0167:60d1f9bb.Registers:EAX=00000000 CS=0167 EIP=60d1f9bb EFLGS=00010212EBX=000002e3 SS=016f ESP=0068f510 EBP=0068f514ECX=00350200 DS=016f ESI=000001ab FS=33bfEDX=0068f578 ES=016f (37838867) Comments: EDI=0068f5ac GS=0000Bytes at CS:EIP:f0 0f b1 0b 0f 94 c0 83 e0 01 85 c0 5b 75 18 8b Stack dump:013c2630 0068f548 60d07679 000002e3 00350200 0068f5a8 0000000a 0068f564 013c8830 7800cd04 013d380c 0085d680 007366a8 224073da 0068f5b4 60d077d6 (37823006) Comments: Booting the computer first thing this morning - that's all - wasn't actually trying to use Netscape 6.2 (37820749) Comments: Booting up my Toshiba Satellite 2250CDT 600 MHzCeleron with192RAM & Windows98 SE (37691963) Comments: Opening (37688361) URL: www.pogo.com Count Offset Real Signature [ 14 js_Lock 83e50136 - js_Lock ] Count Platform List 14 Windows 98 4.10 build 67766446 No of Unique Users 14 (37932589) URL: www.metalblade.com (37932589) Comments: I cancelled a download for one of their plug-ins (37862851) URL: www.discovery.com (37862851) Comments: downloading macromedia flash 5 (37815528) Comments: checking my email (37797867) Comments: I was viewing the newyork web site attempting to take a tour netscape advised D/L java plugin but d/L was too slow so cancelled the option then browser shut down (37699007) Comments: I was looking fur Java on www.netscape.de Count Offset Real Signature [ 7 js_Lock ffc17ffc - js_Lock ] Count Platform List 7 Windows 98 4.10 build 67766446 No of Unique Users 7 (37960795) URL: www.netscape.com (37960795) Comments: loading the page Count Offset Real Signature [ 7 js_Lock dcbc0ec4 - js_Lock ] Count Platform List 7 Windows 98 4.10 build 67766222 No of Unique Users 7 (38070678) Comments: I iniciated Internet Explorer when Netscape failed. (37861758) Comments: loading netscape home page (37836326) URL: www.sparda-ks.de (37836326) Comments: I have closed the site.If i work on thede site inside of membererai miss an icon. This icon is the printicon.If i use an other browser the buttom is there for use. (37801326) Comments: SUFING ARTVAN WEB SITE Count Offset Real Signature [ 7 js_Lock ba6e1b69 - js_Lock ] [ 7 js_Lock 3ddd881e - js_Lock ] [ 5 js_Lock 628487ec - js_Lock ] Count Platform List 7 Windows 98 4.90 build 73010104 7 Windows 98 4.10 build 67766446 5 Windows 98 4.10 build 67766222 No of Unique Users 19 (38053530) Comments: browsing (37921711) Comments: Iwas in a chat room sign in place (37905596) Comments: I was looking web pages (37878725) URL: www.prodigy.com (37878725) Comments: loading home page (37818986) Comments: unknown (37782640) Comments: aa Count Offset Real Signature [ 7 js_Lock 741b6833 - js_Lock ] Count Platform List 5 Windows 98 4.10 build 67766446 2 Windows 98 4.90 build 73010104 No of Unique Users 7 (38008888) URL: ww.yahoo.com.www.wmich.edu (38008888) Comments: I was searching fo rsomethingand looking up a website and it continued to fail (37987936) URL: http://www.mantra.com.ar/Chat/express.html (37842436) Comments: keep getting disconnected while trying to download

I have not been able to reproduce this crash. I've tried going to all the URLs in Jan's report above. One thing I do notice, however, is that many of them involve either Java or Macromedia Flash. For example: games.yahoo.com http://www.mantra.com.ar/Chat/express.html www.jt.lt - (on linked pages you click to at this site) www.sparda-ks.de (go to "Banking Login", then to "Start") Also note these user comments: (37862851) Comments: downloading macromedia flash 5 (37797867) Comments: I was viewing the newyork web site attempting to take a tour Netscape advised D/L java plugin but d/L was too slow so cancelled the option then browser shut down (37699007) Comments: I was looking fur Java on www.netscape.de Therefore, reassigning to Plug-ins to see if they are familiar with this stack trace.

Note: yet another Java-intensive site in Jan's list is www.metalblade.com

Seems like the download rather than plugin thread in the talkback reports may be key: isn't this reminiscent of that xpinstall bug that jband patched for 0.9.4? /be

That would be bug 78442. This got into 0.9.4 (and NS 6.2) but only made it to 0.9.6 and the trunk in the last few days. This could cause various crashes during or just after an install download.

changing topcrash bugs to critical

Could Bug 113996 seen in Moz 0.9.6 (also a crash in js3250.dll) be related? I submitted TalkBack stack traces on 6 December 01 for two occurrences of that crash on my WinME box. (BTW, amazing to see so many of my old friends cc:d on a single bug report. ;-> )

Adding M096 to summary, since this crash is happening in one form or another with Mozilla 0.9.6. We don't have much data for M096 right now...so I'll update this bug with more info if I see this in M097.

Marking WFM, this bug has been around for a while...and hasn't gone anywhere. The latest M097 shows a crash with the same stack signature, but I'm not sure if it's related to these older crashes. I will log a new bug on those crashes.

verified wfm.