Build: 04-25 trunk Win32 build Steps to reproduce: 1. Launch browser, Pregerences | Appearance | Fonts. 2. User Defined, select fonts, e.g. Japanese | MSGothic and Chinese | MingLiu... for Serif, Sans Serif and Fixed-width fonts. 3. Click "OK". Result: Crash on both WinME-Ja and Win2k-Simp. Chinese Not reproduce on: N6.01 and 04-25 Mac and Linux build, however Mac has a problem with display pages after set up User Defined fond, I'll file a seperate bug for that.

Mac bug 77786

talkback?

ID 29669638 Call Stack: (Signature = 0x03f9f7aa 1e983c01) 0x03f9f7aa 0x52005500

Call stack from my debug builded (pulled this morning). nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012f700) line 32 + 23 bytes nsCOMPtr<nsIDOMEventReceiver>::assign_from_helper(const nsCOMPtr_helper & {...}, const nsID & {...}) line 974 + 18 bytes nsCOMPtr<nsIDOMEventReceiver>::nsCOMPtr<nsIDOMEventReceiver>(const nsQueryInterface & {...}) line 568 nsXBLBinding::ExecuteAttachedHandler(nsXBLBinding * const 0x048ada30) line 1357 nsBindingManager::ProcessAttachedQueue(nsBindingManager * const 0x04253bf0) line 955 nsCSSFrameConstructor::CreateTreeWidgetContent(nsCSSFrameConstructor * const 0x0427b4b0, nsIPresContext * 0x0424b4d0, nsIFrame * 0x02bba5d8, nsIFrame * 0x00000000, nsIContent * 0x04937f10, nsIFrame * * 0x02bba670, int 1, int 0, nsILayoutHistoryState * 0x00000000) line 12342 nsXULTreeGroupFrame::GetFirstTreeBox(int * 0x0012fa0c) line 304 nsTreeLayout::LazyRowCreator(nsTreeLayout * const 0x048af570, nsBoxLayoutState & {...}, nsXULTreeGroupFrame * 0x02bba5d8) line 342 + 12 bytes nsXULTreeOuterGroupFrame::ReflowFinished(nsXULTreeOuterGroupFrame * const 0x02bba694, nsIPresShell * 0x0427b110, int * 0x0012faa0) line 1323 PresShell::HandlePostedReflowCallbacks() line 4637 PresShell::ProcessReflowCommands(int 1) line 5824 ReflowEvent::HandleEvent() line 5608 HandlePLEvent(ReflowEvent * 0x0427da00) line 5622 PL_HandleEvent(PLEvent * 0x0427da00) line 588 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00539290) line 518 + 9 bytes _md_EventReceiverProc(HWND__ * 0x006c0588, unsigned int 49374, unsigned int 0, long 5477008) line 1069 + 9 bytes USER32! 77e148dc() USER32! 77e14aa7() USER32! 77e266fd() nsAppShellService::Run(nsAppShellService * const 0x00540120) line 408 main1(int 1, char * * 0x00484380, nsISupports * 0x00000000) line 1005 + 32 bytes main(int 1, char * * 0x00484380) line 1300 + 37 bytes mainCRTStartup() line 338 + 17 bytes KERNEL32! 77e992a6()

Crashes around tree widget code, reassign to hyatt.

Adding keyword intl.

This is crasher. Request it be fixed. Adding nsbeta1 keyword. Please assign M0.9.1 milestone. Does this crasher prevent testing of the feature?

*** Bug 79378 has been marked as a duplicate of this bug. ***

os=all based on dup

*** Bug 79902 has been marked as a duplicate of this bug. ***

Hyatt - This is a crasher, should it be done before M1.0? Request it be fixed for M0.9.1, because a crasher is a beta stopper.

ylong, can you still reproduce this?

Not reproducible on 05-15 trunk build. Mark it as wonkforme for now.

Verified.

I suspect that we have a memory corruption problem that makes the crash happen erratically. The fact that it does not happend all the time does not mean it is not there (just @#$% hard to debug or verify).