To reproduce, 1. Open the "Manage Bookmarks" window (Bookmarks->Manage Bookmarks) 2. Open the "Personal Toolbar Folder" folder 3. Add a folder to the "Personal Toolbar Folder" folder called "Test". 4. Return to the browser window. Bookmark a page using "Bookmarks->Add Bookmark". This is "Bookmark One" 5. Return to the "Manage Bookmarks" window. Use drag and drop to place bookmark one in the folder called "Test" 6. Turn the twisty on "Test" so that it's contents are visible. 7. Return to the browser window. Bookmark another page using "Bookmarks->Add Bookmark". This is "Bookmark Two". 8. Return to the "Manage Bookmarks" window. Drag bookmark two between the "Test" folder and bookmark one. Expected: bookmark is added to "Test" folder. Actual: crash! Looks to be like we're QI()-ing a nuked frame. Here's the stack trace. 02e6378c() nsXULTreeGroupFrame::GetFirstTreeBox(nsXULTreeGroupFrame * const 0x02dc3944, int * 0x00000000) line 223 nsTreeLayout::LazyRowCreator(nsTreeLayout * const 0x02dd5b68, nsBoxLayoutState & {...}, nsXULTreeGroupFrame * 0x00000285) line 308 + 14 bytes nsTreeLayout::LazyRowCreator(nsTreeLayout * const 0x02dd5b68, nsBoxLayoutState & {...}, nsXULTreeGroupFrame * 0x00000285) line 320 nsXULTreeOuterGroupFrame::ReflowFinished(nsXULTreeOuterGroupFrame * const 0x02dd5b68, nsIPresShell * 0x020a1768, int * 0x0012c56c) line 1248 PresShell::HandlePostedReflowCallbacks(PresShell * const 0x02dc3944) line 3658 PresShell::ProcessReflowCommands(PresShell * const 0x02dc3944, int 0) line 4712 PresShell::FlushPendingNotifications(PresShell * const 0x020a1768) line 3722 PresShell::AppendReflowCommand(PresShell * const 0x020a1768, nsIReflowCommand * 0x02e41b10) line 2717 nsFrame::CreateAndPostReflowCommand(nsIPresShell * 0x02e41b10, nsIFrame * 0x02d844e8, nsIReflowCommand::ReflowType ReflowDirty, nsIFrame * 0x00000000, nsIAtom * 0x00000000 {???}, nsIAtom * 0x00000000 {???}) line 3600 nsContainerFrame::ReflowDirtyChild(nsContainerFrame * const 0x02d844b0, nsIPresShell * 0x020a1768, nsIFrame * 0x02d844e8) line 313 + 20 bytes nsBox::RelayoutDirtyChild(nsBox * const 0x21c01004, nsBoxLayoutState & {...}, nsIBox * 0x020a1768) line 460 + 18 bytes nsBox::RelayoutDirtyChild(nsBox * const 0x21801004, nsBoxLayoutState & {...}, nsIBox * 0x02db6438) line 454 + 11 bytes nsBox::RelayoutDirtyChild(nsBox * const 0x20c01034, nsBoxLayoutState & {...}, nsIBox * 0x02e014d8) line 454 + 11 bytes nsBox::RelayoutDirtyChild(nsBox * const 0x00801034, nsBoxLayoutState & {...}, nsIBox * 0x02db6f64) line 454 + 11 bytes nsBox::RelayoutDirtyChild(nsBox * const 0x20c01004, nsBoxLayoutState & {...}, nsIBox * 0x02e0080c) line 454 + 11 bytes nsBox::RelayoutDirtyChild(nsBox * const 0x20c03004, nsBoxLayoutState & {...}, nsIBox * 0x02db6e6c) line 454 + 11 bytes nsBox::RelayoutDirtyChild(nsBox * const 0x00803030, nsBoxLayoutState & {...}, nsIBox * 0x02dc38b4) line 454 + 11 bytes nsBox::RelayoutDirtyChild(nsBox * const 0x00801024, nsBoxLayoutState & {...}, nsIBox * 0x00000000) line 454 + 11 bytes nsBox::MarkDirtyChildren(nsBox * const 0x02dc38b4, nsBoxLayoutState & {...}) line 292 nsXULTreeGroupFrame::ReverseDestroyRows(nsXULTreeGroupFrame * const 0x02dc3944, int & 0) line 611 nsXULTreeGroupFrame::ReverseDestroyRows(nsXULTreeGroupFrame * const 0x02dc3944, int & 0) line 589 nsXULTreeOuterGroupFrame::InternalPositionChanged(nsXULTreeOuterGroupFrame * const 0x02e10f20, int 1, int 1) line 675 nsXULTreeOuterGroupFrame::ScrollToIndex(nsXULTreeOuterGroupFrame * const 0x02dc3944, int 1) line 1161 nsXULTreeGroupFrame::OnContentRemoved(nsXULTreeGroupFrame * const 0x02dc3944, nsIPresContext * 0x00000002, nsIFrame * 0x02e3692c, int 5) line 484 nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x0226f590, nsIPresContext * 0x02debdf8, nsIContent * 0x00c2f2e0 {"treechildren"}, nsIContent * 0x02e8c2d0, int 5) line 9214 StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x0226f0a8, nsIPresContext * 0x01f4e558, nsIContent * 0x02e391a8, nsIContent * 0x02e8c2d0, int 5) line 1166 PresShell::ContentRemoved(PresShell * const 0x020a1770, nsIDocument * 0x00d2c1a0, nsIContent * 0x02e391a8, nsIContent * 0x02e8c2d0, int 5) line 3866 nsXULDocument::ContentRemoved(nsXULDocument * const 0x00d2c1a0, nsIContent * 0x02e391a8, nsIContent * 0x02e8c2d0, int 5) line 1785 nsXULElement::RemoveChildAt(nsXULElement * const 0x02de6e80, int 5, int 1) line 2513 nsXULTemplateBuilder::RemoveMember(nsXULTemplateBuilder * const 0x02dc3944, nsIContent * 0x0227f570, nsIRDFResource * 0x02e8c2d0, int 1) line 6020 + 15 bytes nsXULTemplateBuilder::Retract(nsXULTemplateBuilder * const 0x02dc3944, nsIRDFResource * 0x00d6a550 {"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 {"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 4771 nsXULTemplateBuilder::OnUnassert(nsXULTemplateBuilder * const 0x01ff9be0, nsIRDFDataSource * 0x0229b6f0, nsIRDFResource * 0x00d6a550 {"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 {"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 4814 CompositeDataSourceImpl::OnUnassert(CompositeDataSourceImpl * const 0x00000000, nsIRDFDataSource * 0x00d6a4f4, nsIRDFResource * 0x00d6a550 {"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 {"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 1473 + 16 bytes nsBookmarksService::OnUnassert(nsBookmarksService * const 0x00000004, nsIRDFDataSource * 0x00d6c3f0, nsIRDFResource * 0x00d6a550 {"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 {"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 4715 InMemoryDataSource::Unassert(InMemoryDataSource * const 0x00000001, nsIRDFResource * 0x00d6a550 {"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 {"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 1262 nsBookmarksService::Unassert(nsBookmarksService * const 0x00d6a4f4, nsIRDFResource * 0x00d6a550 {"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 {"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 2977 + 16 bytes RDFContainerImpl::RemoveElementAt(RDFContainerImpl * const 0x01eceb00 {"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, int 32303536, int 1, nsIRDFNode * * 0x0012cd38) line 346 XPTC_InvokeByIndex(nsISupports * 0x02e867f8, unsigned int 11, unsigned int 3, nsXPTCVariant * 0x0012cd18) line 139 nsXPCWrappedNativeClass::CallWrappedMethod(nsXPCWrappedNativeClass * const 0x02dc3944, JSContext * 0x02191808, nsXPCWrappedNative * 0x02e86aa8, const XPCNativeMemberDescriptor * 0x02e8694c, nsXPCWrappedNativeClass::CallMode 50331648, unsigned int 3, long * 0x02e6f698, long * 0x0012ce98) line 913 + 41 bytes WrappedNative_CallMethod(JSContext * 0x02275d58, JSObject * 0x02e6e2f0, unsigned int 3, long * 0x02e6f698, long * 0x0012ce98) line 228 + 99 bytes js_Invoke(JSContext * 0x00000001, unsigned int 3, unsigned int 0) line 790 + 17 bytes js_Interpret(JSContext * 0x02191808, long * 0x0012d0d4) line 2589 + 14 bytes js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 807 + 10 bytes js_InternalInvoke(JSContext * 0x00000000, JSObject * 0x02288a10, long 48685720, unsigned int 0, unsigned int 1, long * 0x0012d294, long * 0x0012d1dc) line 879 + 13 bytes JS_CallFunctionValue(JSContext * 0x02191808, JSObject * 0x02288a10, long 48685720, unsigned int 1, long * 0x0012d294, long * 0x0012d1dc) line 3193 + 25 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x00b7eae8, void * 0x02288a10, void * 0x02e6e298, unsigned int 1, void * 0x0012d294, int * 0x0012d298, int 0) line 907 + 25 bytes nsJSEventListener::HandleEvent(nsJSEventListener * const 0x02dc3944, nsIDOMEvent * 0x02e8626c) line 154 + 32 bytes nsEventListenerManager::HandleEventSubType(nsEventListenerManager * const 0x02dc3944, nsListenerStruct * 0x021419b0, nsIDOMEvent * 0x02e8626c, nsIDOMEventTarget * 0x0227f578, unsigned int 48783988, unsigned int 12788032) line 788 + 8 bytes nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x02dc3944, nsIPresContext * 0x00000000, nsEvent * 0x0012e508, nsIDOMEvent * * 0x00000000, nsIDOMEventTarget * 0x0227f578, unsigned int 2, nsEventStatus * 0x0012e4d4) line 1511 + 16 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, nsEventStatus * 0x0012e4d4) line 3301 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, nsEventStatus * 0x0012e4d4) line 3320 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, nsEventStatus * 0x0012e4d4) line 3320 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, nsEventStatus * 0x0012e4d4) line 3320 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, nsEventStatus * 0x0012e4d4) line 3320 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, nsEventStatus * 0x0012e4d4) line 3320 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, nsEventStatus * 0x0012e4d4) line 3320 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, nsEventStatus * 0x0012e4d4) line 3320 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 1, nsEventStatus * 0x0012e4d4) line 3320 PresShell::HandleEventInternal(PresShell * const 0x02dc3944, nsEvent * 0x02e566b8, nsIView * 0x02e08518, unsigned int 1, nsEventStatus * 0x0012e4d4) line 4420 + 22 bytes PresShell::HandleEvent(PresShell * const 0x020a1768, nsIView * 0x02e08518, nsGUIEvent * 0x0012e508, nsEventStatus * 0x0012e4d4, int 0, int & 1) line 4349 + 17 bytes nsView::HandleEvent(nsView * const 0x00000000, nsGUIEvent * 0x0012e508, unsigned int 8, nsEventStatus * 0x0012e4d4, int 0, int & 1) line 379 nsView::HandleEvent(nsView * const 0x00000000, nsGUIEvent * 0x02e08518, unsigned int 8, nsEventStatus * 0x0012e4d4, int 0, int & 1) line 352 nsView::HandleEvent(nsView * const 0x00000006, nsGUIEvent * 0x020ed210, unsigned int 28, nsEventStatus * 0x0012e4d4, int 1, int & 1) line 352 nsViewManager2::DispatchEvent(nsViewManager2 * const 0x00000726, nsGUIEvent * 0x000000b1, nsEventStatus * 0x0012e4d4) line 1439 HandleEvent(nsGUIEvent * 0x02104008) line 68 nsWindow::DispatchEvent(nsWindow * const 0x02190d44, nsGUIEvent * 0x0012e508, nsEventStatus & nsEventStatus_eIgnore) line 681 + 6 bytes nsNativeDragTarget::DispatchDragDropEvent(nsNativeDragTarget * const 0x02dc3944, unsigned int 0, _POINTL {...}) line 183 + 26 bytes nsNativeDragTarget::ProcessDrag(nsNativeDragTarget * const 0x02dc3944, IDataObject * 0x02e7dd38, unsigned int 1403, unsigned long 2, _POINTL {...}, unsigned long * 0x00c78efc) line 209 nsNativeDragTarget::Drop(nsNativeDragTarget * const 0x02e08178, IDataObject * 0x02e7dd38, unsigned long 0, _POINTL {...}, unsigned long * 0x0012e70c) line 308 OLE32! 77b1f8fa() OLE32! 77b1fad1() OLE32! 77af5545() OLE32! 77af5307() nsDragService::StartInvokingDragSession(nsDragService * const 0x00000002, IDataObject * 0x02e7dd38, unsigned int 3) line 144 nsDragService::InvokeDragSession(nsDragService * const 0x00c78ef8, nsIDOMNode * 0x02e75678, nsISupportsArray * 0x02e75678, nsIScriptableRegion * 0x00000001, unsigned int 3) line 110 + 15 bytes XPTC_InvokeByIndex(nsISupports * 0x00c78ef8, unsigned int 3, unsigned int 4, nsXPTCVariant * 0x0012e788) line 139 nsXPCWrappedNativeClass::CallWrappedMethod(nsXPCWrappedNativeClass * const 0x02dc3944, JSContext * 0x02191808, nsXPCWrappedNative * 0x02e7dac8, const XPCNativeMemberDescriptor * 0x02dd71fc, nsXPCWrappedNativeClass::CallMode 67108864, unsigned int 4, long * 0x02e6f52c, long * 0x0012e908) line 913 + 41 bytes WrappedNative_CallMethod(JSContext * 0x00d40400, JSObject * 0x02e6d760, unsigned int 4, long * 0x02e6f52c, long * 0x0012e908) line 228 + 99 bytes js_Invoke(JSContext * 0x00000001, unsigned int 4, unsigned int 0) line 790 + 17 bytes js_Interpret(JSContext * 0x02191808, long * 0x0012eb44) line 2589 + 14 bytes js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 807 + 10 bytes js_InternalInvoke(JSContext * 0x00000000, JSObject * 0x02288a10, long 48682216, unsigned int 0, unsigned int 1, long * 0x0012ed04, long * 0x0012ec4c) line 879 + 13 bytes JS_CallFunctionValue(JSContext * 0x02191808, JSObject * 0x02288a10, long 48682216, unsigned int 1, long * 0x0012ed04, long * 0x0012ec4c) line 3193 + 25 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x00b7eae8, void * 0x02288a10, void * 0x02e6d4e8, unsigned int 1, void * 0x0012ed04, int * 0x0012ed08, int 0) line 907 + 25 bytes nsJSEventListener::HandleEvent(nsJSEventListener * const 0x02dc3944, nsIDOMEvent * 0x02e76bd4) line 154 + 32 bytes nsEventListenerManager::HandleEventSubType(nsEventListenerManager * const 0x02dc3944, nsListenerStruct * 0x021419b0, nsIDOMEvent * 0x02e76bd4, nsIDOMEventTarget * 0x0227f578, unsigned int 48720860, unsigned int 12788232) line 788 + 8 bytes nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x02dc3944, nsIPresContext * 0x00000000, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x00000000, nsIDOMEventTarget * 0x0227f578, unsigned int 2, nsEventStatus * 0x0012f7cc) line 1511 + 16 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x0012f71c, unsigned int 2, nsEventStatus * 0x0012f7cc) line 3301 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x0012f71c, unsigned int 2, nsEventStatus * 0x0012f7cc) line 3320 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x0012f71c, unsigned int 2, nsEventStatus * 0x0012f7cc) line 3320 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x0012f71c, unsigned int 2, nsEventStatus * 0x0012f7cc) line 3320 nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 0x01f4e558, nsEvent * 0x02e76bdc, nsIDOMEvent * * 0x0012f71c, unsigned int 1, nsEventStatus * 0x0012f7cc) line 3320 nsEventStateManager::GenerateDragGesture(nsEventStateManager * const 0x02dc3944, nsIPresContext * 0x01f4e558, nsGUIEvent * 0x02e33dd0) line 781 nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x02d88028, nsIPresContext * 0x01f4e558, nsEvent * 0x0012fafc, nsIFrame * 0x02e54820, nsEventStatus * 0x0012fabc, nsIView * 0x02e08518) line 304 PresShell::HandleEventInternal(PresShell * const 0x02dc3944, nsEvent * 0x0012fafc, nsIView * 0x02e08518, unsigned int 1, nsEventStatus * 0x0012fabc) line 4411 PresShell::HandleEvent(PresShell * const 0x020a1768, nsIView * 0x02e08518, nsGUIEvent * 0x0012fafc, nsEventStatus * 0x0012fabc, int 1, int & 1) line 4349 + 17 bytes nsView::HandleEvent(nsView * const 0x00000000, nsGUIEvent * 0x0012fafc, unsigned int 28, nsEventStatus * 0x0012fabc, int 1, int & 1) line 379 nsViewManager2::DispatchEvent(nsViewManager2 * const 0x00000339, nsGUIEvent * 0x00000254, nsEventStatus * 0x0012fabc) line 1439 HandleEvent(nsGUIEvent * 0x02104008) line 68 nsWindow::DispatchEvent(nsWindow * const 0x02190d44, nsGUIEvent * 0x0012fafc, nsEventStatus & nsEventStatus_eIgnore) line 681 + 6 bytes nsWindow::DispatchWindowEvent(nsWindow * const 0x02dc3944, nsGUIEvent * 0x00000000) line 702 nsWindow::DispatchMouseEvent(nsWindow * const 0x02dc3944, unsigned int 300, nsPoint * 0x04d626f2 {x=??? y=???}) line 3892 ChildWindow::DispatchMouseEvent(ChildWindow * const 0x02dc3944, unsigned int 300, nsPoint * 0x00000000 {x=??? y=???}) line 4099 + 15 bytes nsWindow::ProcessMessage(nsWindow * const 0x02dc3944, unsigned int 512, unsigned int 1, long 39059511, long * 0x0012fd04) line 2985 nsWindow::WindowProc(HWND__ * 0x003401d4, unsigned int 512, unsigned int 1, long 0) line 950 + 18 bytes USER32! 77e13eb0() USER32! 77e1401a() USER32! 77e192da() nsAppShellService::Run(nsAppShellService * const 0x00ae0848) line 408 main1(int 1, char * * 0x00372758, nsISupports * 0x003727a8) line 1031 + 9 bytes main(int 1, char * * 0x00372758) line 1212 + 25 bytes WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x00133a54, HINSTANCE__ * 0x00400000) line 1230 + 21 bytes MOZILLA! WinMainCRTStartup + 308 bytes KERNEL32! 77e87903()

Wah! This is dogfood because it means I can't arrange bookmarks into folders that are nested >1 level deep.

this was also reported in bug 49894 (Solaris) and more recently in bug 55646 (win98)

Since nsTreeLayout::LazyRowCreator is new (I believe) with evaughan checkin on the trunk, these really are distinct from any prior drag/crashes in trees. Oddly, I could not reproduce this in my own opt build for the trunk on win2k (pulled Sat 2am), but in today's release opt trunk build, just dragging up from the bottom of the tree will trigger this crash (at the point where scrolling is initiated as I drag above the first visible row).

Um, I take that back. I can reproduce this in my own opt. build.

investigating

I hate crashers, but this seems too esay to "work around" to be a dogfood use stopper. Marking dogfood-minus. ...but as a crasher, it sure would be nice to at least stop the crash for RTM ;-). IMO, it would be nice to have the functionality, but stopping the crash would (at this late date) be very acceptable.

This is fixed by the following patch. It has been reviewed by hyatt and is already in the branch. Just needs to go in the trunk.

rtm need info/m18. How did this get into the branch without a double-plus? Who else reviewed it? Why isn't it on the trunk?

This was a regression in the original patch. It worked with the original tree and broke with my patch. So I had hyatt look at it and we fixed the patch. Then we landed the patch on the branch as planned. Its not on the trunk yet because hyatt and I found the real fix last night and want to land it on the trunk. Reassigning to hyatt to attach is drag and drop fix.

*** Bug 56350 has been marked as a duplicate of this bug. ***

rtm-, fixed on branch, need a more extensive fix on trunk.

Adding topcrash keyword. This is showing up in talkback reports under signatures "0x00000000" (some of them, not all) and "nsQueryInterface::operator()". User comments mention dragging bookmarks and dragging messages in mail (and one said "preferences"). See http://www.mozilla.org/projects/seamonkey/reports/ns6analysis.html

See also bug 56349. RDF is sending too many "remove" notifications to the tree widget, which may be wedging it when combined with async reflow.

*** Bug 57407 has been marked as a duplicate of this bug. ***

ooh look, a bookmarks related bug that claudius wasn't cc'd on tsk,tsk. Bug 55646 will soon be marked as a dupe of this. Bug 55646 was observed on all platforms and is easily repro'd by dragging any BM enough such that the window has to autoscroll. So if I'm reading correctly this should not be an issue on new branch builds?

Yes, this should not appear in the branch builds. (Sorry for no CC. Although this can happen in any tree).

I cannot reproduce the crash in 2000-10-23-15 using the original instructions. Feel free to close the bug, hyatt.

There don't seem to be any talkback reports of this crash since 10-19 (Saturdays and Sundays are usually slow, but not Fridays, I don't think...).

I still see this in a new _trunk_ build from today...?

Oh wait, maybe I'm dumb. Is bug 55646 now covering the crash in the trunk? Or what?

No, it could just be nobody was using talkback builds on Friday...

*** Bug 55646 has been marked as a duplicate of this bug. ***

This is still crashing in the trunk, and this is the bug for this "autoscroll" crash in tree widgets (including the bookmarks manager).

Another way to reproduce: 1. Mailnews 2. Open so many folders that you get a vert. scrollbar in the folder pane. 3. Drag msg to bottom of folder pane -> autoscroll 4. Drag over window border (i.e. outside the Mozilla Mailnews window) Crash. No crash with attached patch applied. Can we please get the patch into the trunk until a better solution is in hand?

Seeing this on Linux -> All, all.

Sounds reasonable to me, ->m18.

*** Bug 58224 has been marked as a duplicate of this bug. ***

*** Bug 57767 has been marked as a duplicate of this bug. ***

*** Bug 58394 has been marked as a duplicate of this bug. ***

Fixed.