On builds 2001040204 and 20010403 on Win98 SE, with both mail/news and browser open (only one open doesn't cause crash). Switching themes and then closing browser window causes crash of entire program, every time. MOZILLA caused an invalid page fault in module GKLAYOUT.DLL at 017f:60384e46. Registers: EAX=012ed5dc CS=017f EIP=60384e46 EFLGS=00010202 EBX=00000000 SS=0187 ESP=0068d948 EBP=0068d95c ECX=00000000 DS=0187 ESI=00000000 FS=619f EDX=603b3654 ES=0187 EDI=00ef0006 GS=0000 Bytes at CS:EIP: ff 51 18 eb 02 33 c0 c2 08 00 8b 4c 24 04 e8 8c Stack dump: 012ed5dc 00000001 60e2109a 016f0c70 00000001 0068da7c 60aef505 016f0c70 00000006 00000001 0068d984 00efdb80 01e208b0 01e20730 00efdb80 00000001

Confirming bug under Windows ME (2001040304)

I crash in Windows 2000 with a fresh pull. Here's the stack: nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012ebcc) line 32 + 23 bytes nsCOMPtr<nsIBoxObject>::assign_from_helper(const nsCOMPtr_helper & {...}, const nsID & {...}) line 970 + 18 bytes nsCOMPtr<nsIBoxObject>::nsCOMPtr<nsIBoxObject>(const nsQueryInterface & {...}) line 564 nsOutlinerBodyFrame::Destroy(nsOutlinerBodyFrame * const 0x03d9a890, nsIPresContext * 0x054ebce0) line 306 nsFrameList::DestroyFrames(nsIPresContext * 0x054ebce0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x03dd8e30, nsIPresContext * 0x054ebce0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x03dd8e30, nsIPresContext * 0x054ebce0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x054ebce0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x03dd90e4, nsIPresContext * 0x054ebce0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x03dd90e4, nsIPresContext * 0x054ebce0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x054ebce0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x03d46988, nsIPresContext * 0x054ebce0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x03d46988, nsIPresContext * 0x054ebce0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x054ebce0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x03d776c0, nsIPresContext * 0x054ebce0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x03d776c0, nsIPresContext * 0x054ebce0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x054ebce0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x03d7783c, nsIPresContext * 0x054ebce0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x03d7783c, nsIPresContext * 0x054ebce0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x054ebce0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x03d77218, nsIPresContext * 0x054ebce0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x03d77218, nsIPresContext * 0x054ebce0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x054ebce0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x03d93414, nsIPresContext * 0x054ebce0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x03d93414, nsIPresContext * 0x054ebce0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x054ebce0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x03d93384, nsIPresContext * 0x054ebce0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x03d93384, nsIPresContext * 0x054ebce0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x054ebce0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x03d93348, nsIPresContext * 0x054ebce0) line 98 ViewportFrame::Destroy(ViewportFrame * const 0x03d93348, nsIPresContext * 0x054ebce0) line 142 FrameManager::Destroy(FrameManager * const 0x054ec2b0) line 422 PresShell::~PresShell() line 1422 PresShell::`scalar deleting destructor'() + 15 bytes PresShell::Release(PresShell * const 0x054ecd50) line 1330 + 158 bytes nsCOMPtr<nsIPresShell>::~nsCOMPtr<nsIPresShell>() line 489 DocumentViewerImpl::~DocumentViewerImpl() line 829 + 86 bytes DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes DocumentViewerImpl::Release(DocumentViewerImpl * const 0x054e90e0) line 806 + 154 bytes nsCOMPtr<nsIContentViewer>::assign_assuming_AddRef(nsIContentViewer * 0x00000000) line 471 nsCOMPtr<nsIContentViewer>::assign_with_AddRef(nsISupports * 0x00000000) line 963 nsCOMPtr<nsIContentViewer>::operator=(nsIContentViewer * 0x00000000) line 583 nsDocShell::Destroy(nsDocShell * const 0x054cd1e4) line 1756 nsWebShell::Destroy(nsWebShell * const 0x054cd1e4) line 1431 nsXULWindow::Destroy(nsXULWindow * const 0x054cd7b4) line 358 nsWebShellWindow::Destroy(nsWebShellWindow * const 0x054cd7b4) line 1737 + 9 bytes nsWebShellWindow::Close(nsWebShellWindow * const 0x054cd824) line 340 nsWebShellWindow::HandleEvent(nsGUIEvent * 0x0012f4b8) line 410 nsWindow::DispatchEvent(nsWindow * const 0x054cd5c4, nsGUIEvent * 0x0012f4b8, nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f4b8) line 716 nsWindow::DispatchStandardEvent(unsigned int 101) line 736 + 15 bytes nsWindow::ProcessMessage(unsigned int 16, unsigned int 0, long 0, long * 0x0012f820) line 2822 nsWindow::WindowProc(HWND__ * 0x000d02b4, unsigned int 16, unsigned int 0, long 0) line 950 + 27 bytes

same stack as bug 74902. I'd just dup this one.

*** This bug has been marked as a duplicate of 74902 ***

Okey-dokey. Vrfy.