Using 2001040604 on Win NT. 1. Open 3 pane window 2. Open up search dialog 3. type the first criteria in. 4. crash. cc'ing naving so he can add the stack trace.

Here is the stack trace... nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012b4c4) line 32 + 23 bytes nsCOMPtr<nsIContent>::assign_from_helper(const nsCOMPtr_helper & {...}, const nsID & {...}) line 970 + 18 bytes nsCOMPtr<nsIContent>::nsCOMPtr<nsIContent>(const nsQueryInterface & {...}) line 564 nsXBLWindowKeyHandler::EnsureHandlers() line 89 nsXBLWindowKeyHandler::WalkHandlers(nsXBLWindowKeyHandler * const 0x07bd4090, nsIDOMEvent * 0x07e4c124, nsIAtom * 0x0260b0f0) line 114 nsXBLWindowKeyHandler::KeyDown(nsIDOMEvent * 0x07e4c124) line 143 nsEventListenerManager::HandleEvent(nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, nsIDOMEventTarget * 0x0778fd5c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 1293 + 23 bytes nsXULDocument::HandleDOMEvent(nsXULDocument * const 0x0778fd40, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 1908 nsXULElement::HandleDOMEvent(nsXULElement * const 0x077958e0, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3694 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x0785c580, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x0785c500, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07bcfaa0, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x0785de40, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x0785dd60, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07b9e1a0, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07b9e050, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07be7290, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07b9fa20, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07da3690, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07da34e0, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07da4a90, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07da2950, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07dc8630, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x07dcf6c0, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 2, nsEventStatus * 0x0012f7c8) line 3688 + 53 bytes nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x07dcf4e0, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x0012f39c, unsigned int 1, nsEventStatus * 0x0012f7c8) line 1519 + 53 bytes nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x07dcf4e0, nsIPresContext * 0x07790550, nsEvent * 0x0012f85c, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus * 0x0012f7c8) line 1141 + 29 bytes PresShell::HandleEventInternal(nsEvent * 0x0012f85c, nsIView * 0x07c21aa0, unsigned int 1, nsEventStatus * 0x0012f7c8) line 5125 + 47 bytes PresShell::HandleEvent(PresShell * const 0x07791594, nsIView * 0x07c21aa0, nsGUIEvent * 0x0012f85c, nsEventStatus * 0x0012f7c8, int 0, int & 1) line 5052 + 25 bytes nsView::HandleEvent(nsView * const 0x07c21aa0, nsGUIEvent * 0x0012f85c, unsigned int 8, nsEventStatus * 0x0012f7c8, int 0, int & 1) line 379 nsView::HandleEvent(nsView * const 0x07c20850, nsGUIEvent * 0x0012f85c, unsigned int 8, nsEventStatus * 0x0012f7c8, int 0, int & 1) line 352 nsView::HandleEvent(nsView * const 0x07791cd0, nsGUIEvent * 0x0012f85c, unsigned int 28, nsEventStatus * 0x0012f7c8, int 1, int & 1) line 352 nsViewManager::DispatchEvent(nsViewManager * const 0x07791ed0, nsGUIEvent * 0x0012f85c, nsEventStatus * 0x0012f7c8) line 1996 HandleEvent(nsGUIEvent * 0x0012f85c) line 68 nsWindow::DispatchEvent(nsWindow * const 0x07c20714, nsGUIEvent * 0x0012f85c, nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f85c) line 716 nsWindow::DispatchKeyEvent(unsigned int 133, unsigned short 0, unsigned int 71) line 2330 + 15 bytes nsWindow::OnKeyDown(unsigned int 71, unsigned int 34) line 2361 + 25 bytes nsWindow::ProcessMessage(unsigned int 256, unsigned int 71, long 2228225, long * 0x0012fc10) line 2948 + 32 bytes nsWindow::WindowProc(HWND__ * 0x0154067c, unsigned int 256, unsigned int 71, long 2228225) line 950 + 27 bytes USER32! 77e71820()

adding various keywords. making a blocker and p1.

it's not search only.

My steps are: Load the browser, click the mail icon in task bar, get pass dialog, type in pass, hit enter, crash. I'm using the vertical layout opposed to the typical one, if that makes any difference.

Call stack: nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012d910) line 32 + 23 bytes nsCOMPtr<nsIContent>::assign_from_helper(const nsCOMPtr_helper & {...}, const nsID & {...}) line 970 + 18 bytes nsCOMPtr<nsIContent>::nsCOMPtr<nsIContent>(const nsQueryInterface & {...}) line 564 nsXBLWindowKeyHandler::EnsureHandlers() line 89 nsXBLWindowKeyHandler::WalkHandlers(nsXBLWindowKeyHandler * const 0x0502c660, nsIDOMEvent * 0x029aac14, nsIAtom * 0x02b7dbc0) line 114 nsXBLWindowKeyHandler::KeyUp(nsIDOMEvent * 0x029aac14) line 138 nsEventListenerManager::HandleEvent(nsIPresContext * 0x04723ee0, nsEvent * 0x0012f7d8, nsIDOMEvent * * 0x0012f59c, nsIDOMEventTarget * 0x04721b6c, unsigned int 2, nsEventStatus * 0x0012f744) line 1290 + 23 bytes nsXULDocument::HandleDOMEvent(nsXULDocument * const 0x04721b50, nsIPresContext * 0x04723ee0, nsEvent * 0x0012f7d8, nsIDOMEvent * * 0x0012f59c, unsigned int 2, nsEventStatus * 0x0012f744) line 1908 nsXULElement::HandleDOMEvent(nsXULElement * const 0x04736a30, nsIPresContext * 0x04723ee0, nsEvent * 0x0012f7d8, nsIDOMEvent * * 0x0012f59c, unsigned int 2, nsEventStatus * 0x0012f744) line 3694 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x04e14e80, nsIPresContext * 0x04723ee0, nsEvent * 0x0012f7d8, nsIDOMEvent * * 0x0012f59c, unsigned int 2, nsEventStatus * 0x0012f744) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x04e12fa0, nsIPresContext * 0x04723ee0, nsEvent * 0x0012f7d8, nsIDOMEvent * * 0x0012f59c, unsigned int 2, nsEventStatus * 0x0012f744) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x04e12880, nsIPresContext * 0x04723ee0, nsEvent * 0x0012f7d8, nsIDOMEvent * * 0x0012f59c, unsigned int 2, nsEventStatus * 0x0012f744) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x04e14d20, nsIPresContext * 0x04723ee0, nsEvent * 0x0012f7d8, nsIDOMEvent * * 0x0012f59c, unsigned int 2, nsEventStatus * 0x0012f744) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x04e143c0, nsIPresContext * 0x04723ee0, nsEvent * 0x0012f7d8, nsIDOMEvent * * 0x0012f59c, unsigned int 2, nsEventStatus * 0x0012f744) line 3688 + 53 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x04e14b70, nsIPresContext * 0x04723ee0, nsEvent * 0x0012f7d8, nsIDOMEvent * * 0x0012f59c, unsigned int 1, nsEventStatus * 0x0012f744) line 3688 + 53 bytes PresShell::HandleEventInternal(nsEvent * 0x0012f7d8, nsIView * 0x04723740, unsigned int 1, nsEventStatus * 0x0012f744) line 5125 + 47 bytes PresShell::HandleEvent(PresShell * const 0x04724d54, nsIView * 0x04723740, nsGUIEvent * 0x0012f7d8, nsEventStatus * 0x0012f744, int 1, int & 1) line 5052 + 25 bytes nsView::HandleEvent(nsView * const 0x04723740, nsGUIEvent * 0x0012f7d8, unsigned int 28, nsEventStatus * 0x0012f744, int 1, int & 1) line 379 nsViewManager::DispatchEvent(nsViewManager * const 0x047238e0, nsGUIEvent * 0x0012f7d8, nsEventStatus * 0x0012f744) line 1996 HandleEvent(nsGUIEvent * 0x0012f7d8) line 68 nsWindow::DispatchEvent(nsWindow * const 0x04723604, nsGUIEvent * 0x0012f7d8, nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f7d8) line 716 nsWindow::DispatchKeyEvent(unsigned int 132, unsigned short 0, unsigned int 13) line 2330 + 15 bytes nsWindow::OnKeyUp(unsigned int 13, unsigned int 49180) line 2407 + 22 bytes nsWindow::ProcessMessage(unsigned int 257, unsigned int 13, long -1071906815, long * 0x0012fb88) line 2909 + 34 bytes nsWindow::WindowProc(HWND__ * 0x005f035e, unsigned int 257, unsigned int 13, long -1071906815) line 950 + 27 bytes USER32! 77e148dc() USER32! 77e14aa7() USER32! 77e266fd() nsAppShellService::Run(nsAppShellService * const 0x0058a360) line 408 main1(int 1, char * * 0x004b4180, nsISupports * 0x00000000) line 1021 + 32 bytes main(int 1, char * * 0x004b4180) line 1316 + 37 bytes mainCRTStartup() line 338 + 17 bytes KERNEL32! 77e992a6()

I'm trying to back out the last change to nsPresShell.cpp to see if that's what caused this regression.

that wasn't it perhaps recent changes to nsComposerController.cpp...

giving this to hyatt, I'm not the proper owner. note, we are extending <xul:textbox> in our search term widget, if that helps.

*** Bug 75043 has been marked as a duplicate of this bug. ***

Put this in AddElementToDocumentPost(), so the onattach handler can properly access any child nodes.

if it still works after doing that, sr=waterson. ;-)

Fixed.

verified. thanks for fixing two mailnews blockers today, dave.

*** Bug 76556 has been marked as a duplicate of this bug. ***