Using apr11 commercial trunk build, linux rh6.2 and mac OS 9.0 Can't reproduce with win98 There are two ways I can crash Netscape involving Search Messages being open when exiting or closing the dialog... I think these are probably the same crash. Scenario 1: 1. Launch to Browser, go to mail window, login or don't login to mail account (doesn't seem to make a difference), Search|Search Mail/News. 2. Leave search messages ui open, File|Quit from mail window. Result: crashes. Scenario 2: 1. Launch to Browser, go to mail window, login or don't, Search|Search Mail/News. 2. Leave search ui open, Close mail window (browser still open). 3. Use the Close button in search ui. Result: crashes.

I've seen that too. hyatt may have a bug on this already.

I'm in the middle of converting the subscribe dialog to use the outliner bridge that waterson wrote. on close of subscribe, I see the same thing every time. I've also seen this when closing mail. here is my stack from when closing the subscribe dialog: nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012c880) line 32 + 23 bytes nsCOMPtr<nsIBoxObject>::assign_from_helper(const nsCOMPtr_helper & {...}, const nsID & {...}) line 970 + 18 bytes nsCOMPtr<nsIBoxObject>::nsCOMPtr<nsIBoxObject>(const nsQueryInterface & {...}) line 564 nsOutlinerBodyFrame::Destroy(nsOutlinerBodyFrame * const 0x0130e330, nsIPresContext * 0x05aaddb0) line 306 nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x0130e1cc, nsIPresContext * 0x05aaddb0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x0130e1cc, nsIPresContext * 0x05aaddb0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x0130e13c, nsIPresContext * 0x05aaddb0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x0130e13c, nsIPresContext * 0x05aaddb0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x0130d604, nsIPresContext * 0x05aaddb0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x0130d604, nsIPresContext * 0x05aaddb0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x0130d574, nsIPresContext * 0x05aaddb0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x0130d574, nsIPresContext * 0x05aaddb0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x0130b388, nsIPresContext * 0x05aaddb0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x0130b388, nsIPresContext * 0x05aaddb0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x0130b148, nsIPresContext * 0x05aaddb0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x0130b148, nsIPresContext * 0x05aaddb0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x0130b004, nsIPresContext * 0x05aaddb0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x0130b004, nsIPresContext * 0x05aaddb0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x0130af74, nsIPresContext * 0x05aaddb0) line 98 nsBoxFrame::Destroy(nsBoxFrame * const 0x0130af74, nsIPresContext * 0x05aaddb0) line 1008 + 13 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42 nsContainerFrame::Destroy(nsContainerFrame * const 0x0130af38, nsIPresContext * 0x05aaddb0) line 98 ViewportFrame::Destroy(ViewportFrame * const 0x0130af38, nsIPresContext * 0x05aaddb0) line 142 FrameManager::Destroy(FrameManager * const 0x05aae370) line 422 PresShell::~PresShell() line 1422 PresShell::`scalar deleting destructor'() + 15 bytes PresShell::Release(PresShell * const 0x05aaed50) line 1330 + 158 bytes nsView::HandleEvent(nsView * const 0x05aad580, nsGUIEvent * 0x0012d050, unsigned int 28, nsEventStatus * 0x0012cf44, int 1, int & 1) line 377 + 18 bytes nsViewManager::DispatchEvent(nsViewManager * const 0x05aad780, nsGUIEvent * 0x0012d050, nsEventStatus * 0x0012cf44) line 2001 HandleEvent(nsGUIEvent * 0x0012d050) line 68 nsWindow::DispatchEvent(nsWindow * const 0x05aad444, nsGUIEvent * 0x0012d050, nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012d050) line 716 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=??? y=???}) line 4018 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=??? y=???}) line 4263 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 21627096, long * 0x0012d408) line 3000 + 24 bytes nsWindow::WindowProc(HWND__ * 0x01df0552, unsigned int 514, unsigned int 0, long 21627096) line 950 + 27 bytes USER32! 77e71820() $E2() line 844 + 14 bytes

Hey dave, I think this is probably your bug. It looks like what is happening is that the box object is going away without notifying the frame.

I see this too on pretty much all RDF outliners. This is a dup of one of my bugs, Seth.

hyatt, search and threadpane aren't rdf outliners. I'll look at your bug list for a dup.

it's a duplicate of #74902. *** This bug has been marked as a duplicate of 74902 ***

Verified as a duplicate. Also, looks like fix is good -- no crash in apr18 commercial trunk build with win98 and linux rh6.2. Mac build not yet available.