Various event related problems, hopefully all the same root bug. I'll let you split into multiple bugs if necessary. This can be tested after the M7 tree is open and new Editor UI is available Use the background color button (the right side of the color widget on the editor toolbar) to change background color over and over (Click on button, click on color item.) It is not very reproduceable, but will happen eventually. Related behavior: When you click on a titled button with a popup, it doesn't display as a "depressed" button before poping up the menu. Also, once the menu is up and you select an item, sometimes the button remains in the depressed state. Sometimes the button NEXT to the one originally pressed goes into the depressed state. Here's one stack: nsGenericElement::HandleDOMEvent(nsIPresContext & {...}, nsEvent * 0x0012f9c0, nsIDOMEvent * * 0x0012f908, unsigned int 2, nsEventStatus & nsEventStatus_eIgnore) line 772 + 33 bytes nsHTMLHeadingElement::HandleDOMEvent(nsHTMLHeadingElement * const 0x0150fd6c, nsIPresContext & {...}, nsEvent * 0x0012f9c0, nsIDOMEvent * * 0x0012f908, unsigned int 2, nsEventStatus & nsEventStatus_eIgnore) line 191 nsGenericDOMDataNode::HandleDOMEvent(nsIPresContext & {...}, nsEvent * 0x0012f9c0, nsIDOMEvent * * 0x0012f908, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 718 + 39 bytes nsTextNode::HandleDOMEvent(nsTextNode * const 0x014db2cc, nsIPresContext & {...}, nsEvent * 0x0012f9c0, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 189 nsEventStateManager::GenerateMouseEnterExit(nsIPresContext & {...}, nsGUIEvent * 0x0012fca4) line 363 nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x0159b280, nsIPresContext & {...}, nsGUIEvent * 0x0012fca4, nsIFrame * 0x014def60, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 109 PresShell::HandleEvent(PresShell * const 0x0150b8b4, nsIView * 0x0150f320, nsGUIEvent * 0x0012fca4, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2009 + 39 bytes nsView::HandleEvent(nsView * const 0x0150f320, nsGUIEvent * 0x0012fca4, unsigned int 8, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 833 nsView::HandleEvent(nsView * const 0x0150ea20, nsGUIEvent * 0x0012fca4, unsigned int 8, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 818 nsView::HandleEvent(nsView * const 0x0150e950, nsGUIEvent * 0x0012fca4, unsigned int 8, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 818 nsView::HandleEvent(nsView * const 0x0150b500, nsGUIEvent * 0x0012fca4, unsigned int 28, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 818 nsViewManager::DispatchEvent(nsViewManager * const 0x0150bec0, nsGUIEvent * 0x0012fca4, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 1733 HandleEvent(nsGUIEvent * 0x0012fca4) line 67 nsWindow::DispatchEvent(nsWindow * const 0x0150eaf4, nsGUIEvent * 0x0012fca4, nsEventStatus & nsEventStatus_eIgnore) line 410 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fca4) line 431 nsWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 2881 + 15 bytes ChildWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 3030 nsWindow::ProcessMessage(unsigned int 512, unsigned int 0, long 2883629, long * 0x0012fe3c) line 2232 + 24 bytes nsWindow::WindowProc(void * 0x000702be, unsigned int 512, unsigned int 0, long 2883629) line 474 + 27 bytes USER32! 77e71250() Note: mParent is already deleted at the break point in nsGenericElement::HandleDOMEvent =========================== A different stack after a crash using the popup: nsFrame::GetContent(const nsFrame * const 0x01501f30, nsIContent * * 0x0012f9f4) line 384 + 24 bytes nsEventStateManager::GenerateMouseEnterExit(nsIPresContext & {...}, nsGUIEvent * 0x0012fca4) line 324 nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x015976b0, nsIPresContext & {...}, nsGUIEvent * 0x0012fca4, nsIFrame * 0x01501f30, nsEventStatus & nsEventStatus_eIgnore) line 109 PresShell::HandleEvent(PresShell * const 0x014fe804, nsIView * 0x01501a00, nsGUIEvent * 0x0012fca4, nsEventStatus & nsEventStatus_eIgnore) line 2009 + 39 bytes nsView::HandleEvent(nsView * const 0x01501a00, nsGUIEvent * 0x0012fca4, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 833 nsView::HandleEvent(nsView * const 0x01500920, nsGUIEvent * 0x0012fca4, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 818 nsView::HandleEvent(nsView * const 0x01500f50, nsGUIEvent * 0x0012fca4, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 818 nsView::HandleEvent(nsView * const 0x014fe450, nsGUIEvent * 0x0012fca4, unsigned int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 818 nsViewManager::DispatchEvent(nsViewManager * const 0x014fe120, nsGUIEvent * 0x0012fca4, nsEventStatus & nsEventStatus_eIgnore) line 1733 HandleEvent(nsGUIEvent * 0x0012fca4) line 67 nsWindow::DispatchEvent(nsWindow * const 0x01501124, nsGUIEvent * 0x0012fca4, nsEventStatus & nsEventStatus_eIgnore) line 410 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fca4) line 431 nsWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 2881 + 15 bytes ChildWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 3030 nsWindow::ProcessMessage(unsigned int 512, unsigned int 0, long 4456533, long * 0x0012fe3c) line 2232 + 24 bytes nsWindow::WindowProc(void * 0x00580336, unsigned int 512, unsigned int 0, long 4456533) line 474 + 27 bytes USER32! 77e71250() js_AtomicAdd(long *, long) line 191 + 33 bytes

Moving to M10.

resolving as fixed

Sorry for spam, re-assigning phillip's QA contact XPToolkit/XPWidget bugs to claudius due to restructure

VERFIED fixed for the 1999102808 build