5/3 builds on Linux/Mac/Win95 are crashing after opening the Editor from the Task Menu, typing any amount of text, and closing the window. Expected results would be the window simply closing without crashing. Marking as a blocker bug.

Adding to QA Blocker radar.

This looks like the same crash as bug 4883 (which has been fixed). It's crashing in widget. Ccing pinkerton.

Here's the stack: 043B0440 PPC 180D7EB4 main+007BC 043B02A0 PPC 15C202FC nsAppShellService::Run()+00020 043B0260 PPC 15C0B5AC nsAppShell::Run()+00050 043B01E0 PPC 15C0C0B0 nsMacMessagePump::DoMessagePump()+00044 043B0190 PPC 15C0C27C nsMacMessagePump::DispatchEvent(int, EventRecord*)+ 00084 043B0140 PPC 15C0C8A4 nsMacMessagePump::DoMouseDown(EventRecord&)+003E0 043B0050 PPC 15C0CFDC nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort *)+0004C 043B0000 PPC 15C068C8 nsMacMessageSink::DispatchOSEvent(EventRecord&, GrafPort*)+00048 043AFFC0 PPC 15C01DD0 nsMacWindow::HandleOSEvent(EventRecord&)+0004C 043AFF60 PPC 15C021C0 nsMacEventHandler::HandleOSEvent(EventRecord&)+000B0 043AFF10 PPC 15C030A0 nsMacEventHandler::HandleMouseDownEvent(EventRecord& )+00120 043AFE60 PPC 15BE8D68 nsWindow::Destroy()+00090 043AFE20 PPC 15BEADDC nsWindow::ReportDestroyEvent()+00074 043AFDC0 PPC 15BEAAFC nsWindow::DispatchWindowEvent(nsGUIEvent&)+00028 043AFD80 PPC 15BEAA04 nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus& )+000A8 043AFD30 PPC 15C21FE0 nsWebShellWindow::HandleEvent(nsGUIEvent*)+000E4 043AFCE0 PPC 15C21DF0 nsWebShellWindow::Close()+00038 043AFC90 PPC 15BBA494 nsWebShell::Destroy()+000CC 043AFC50 PPC 15BB9604 nsWebShell::DestroyChildren()+0006C 043AFC00 PPC 15BBA47C nsWebShell::Destroy()+000B4 043AFBC0 PPC 15BB3578 DocumentViewerImpl::Release()+0006C 043AFB80 PPC 15BB3878 DocumentViewerImpl::~DocumentViewerImpl()+00164 043AFB30 PPC 15BB2E5C NSGetFactory+004C0 043AFAF0 PPC 15BAB494 nsCOMPtr_base::~nsCOMPtr_base()+00038 043AFAB0 PPC 15B5A670 nsViewManager::Release()+00044 043AFA70 PPC 15B615A8 nsView::Destroy()+00028 043AFA30 PPC 15B60EAC nsView::~nsView()+00090 043AF9E0 PPC 15B615A8 nsView::Destroy()+00028 043AF9A0 PPC 15B54B88 nsScrollingView::~nsScrollingView()+000C0 043AF960 PPC 15B60EAC nsView::~nsView()+00090 043AF910 PPC 15B615A8 nsView::Destroy()+00028 043AF8D0 PPC 15B536B8 ScrollBarView::~ScrollBarView()+00030 043AF890 PPC 15B60F64 nsView::~nsView()+00148 043AF840 PPC 15B5E810 nsViewManager::RemoveChild(nsIView*, nsIView*)+000A8 043AF7F0 PPC 15B5D548 nsViewManager::UpdateView(nsIView*, nsIRegion*, unsigned int)+00 098 043AF7A0 PPC 15B5D784 nsViewManager::UpdateView(nsIView*, const nsRect&, unsigned int) +001D4 043AF720 PPC 15B5D340 nsViewManager::UpdateDirtyViews(nsIView*, nsRect*) const+001D0 043AF690 PPC 15BE9908 nsWindow::Invalidate(const nsRect&, int)+00068 043AF620 PPC 15BEB8DC nsWindow::ConvertToDeviceCoordinates(int&, int&)+ 0002C 043AF5E0 PPC 15BEB41C nsWindow::CalcOffset(int&, int&)+000C4

it's a different bug. The one i fixed (4883) was because the timer had yet to release the widget so it was sticking around after the window went away. This is dying (it appears) because the code is trying to refresh the window while the window is going away as a result of removing subchildren from the view. I don't believe it has anything to do with widgets, per se.

Isn't this pretty much the same as http://bugzilla.mozilla.org/show_bug.cgi?id=5793 which chofmann has just made a M6 bug?

This appears to be caused by leakage on the pres shell (one per key typed). There is a slightly different crash in viewer, if you go into editor mode, type, then close the window.

Changed to M5

We have a fix for this; we were leaking the pres shell when you hit the space key (and in a few other places), and also releasing it one too many times on editor destruction.

Fix checked in. When testing, be sure to type characters including spaces, returns etc, and make formatting changes.

verified in 5/4 linux and windows build. Reporter(Paul) also verified it as well....