I get the following crash when I open the Mailnews sidebar. It's generally only happening when an account is open. To reproduce: 1. Start mailnews 2. Click on a twisty next to one of your accounts to show folders 3. Close the sidebar 4. Open the sidebar and crash. This also happens to me sometimes when hitting the close box on the title bar. It looks like it's crashing because mFrameManager has been destroyed. PresShell::SetPrimaryFrameFor(PresShell * const 0x0ab2b1c0, nsIContent * 0x0b476480, nsIFrame * 0x00000000) line 1872 + 23 bytes DeletingFrameSubtree(nsIPresContext * 0x0ae85850, nsIPresShell * 0x0ab2b1c0, nsIFrame * 0x0a707cf8, nsIFrame * 0x0a707cf8) line 4531 nsCSSFrameConstructor::RemoveMappingsForFrameSubtree(nsCSSFrameConstructor * const 0x0ab2b2b0, nsIPresContext * 0x0ae85850, nsIFrame * 0x0a707cf8) line 4590 + 26 bytes nsTreeRowGroupFrame::Destroy(nsTreeRowGroupFrame * const 0x0b3189a0, nsIPresContext & {...}) line 84 nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x0b30d8a0, nsIPresContext & {...}) line 88 nsTableFrame::Destroy(nsTableFrame * const 0x0b30d8a0, nsIPresContext & {...}) line 368 nsTreeFrame::Destroy(nsTreeFrame * const 0x0b30d8a0, nsIPresContext & {...}) line 284 nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x0b30c030, nsIPresContext & {...}) line 88 nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x0b318610) line 158 nsBlockFrame::Destroy(nsBlockFrame * const 0x0b309f90, nsIPresContext & {...}) line 822 + 16 bytes nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x011d6dd8, nsIPresContext & {...}) line 88 nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x0b308c30, nsIPresContext & {...}) line 88 nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x0b304050, nsIPresContext & {...}) line 88 ViewportFrame::Destroy(ViewportFrame * const 0x0b304050, nsIPresContext & {...}) line 131 PresShell::~PresShell() line 479 PresShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes PresShell::Release(PresShell * const 0x0ab2b1c0) line 410 + 34 bytes nsCOMPtr<nsIPresShell>::~nsCOMPtr<nsIPresShell>() line 474 DocumentViewerImpl::~DocumentViewerImpl() line 295 + 22 bytes DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes DocumentViewerImpl::Release(DocumentViewerImpl * const 0x0ae831d0) line 237 + 99 bytes nsWebShell::Destroy(nsWebShell * const 0x0aee9d90) line 1136 + 27 bytes nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame() line 474 nsHTMLFrameInnerFrame::`scalar deleting destructor'(unsigned int 1) + 15 bytes nsFrame::Destroy(nsFrame * const 0x0aeeaf80, nsIPresContext & {...}) line 413 + 34 bytes nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x0ae195d0, nsIPresContext & {...}) line 88 nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x01180170, nsIPresContext & {...}) line 88 nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x01179018, nsIPresContext & {...}) line 88 nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x0118a290, nsIPresContext & {...}) line 88 nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x0ae0e3b0, nsIPresContext & {...}) line 88 nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29 nsContainerFrame::Destroy(nsContainerFrame * const 0x0ae00960, nsIPresContext & {...}) line 88 ViewportFrame::Destroy(ViewportFrame * const 0x0ae00960, nsIPresContext & {...}) line 131 PresShell::~PresShell() line 479 PresShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes PresShell::Release(PresShell * const 0x0ad507f0) line 410 + 34 bytes nsCOMPtr<nsIPresShell>::~nsCOMPtr<nsIPresShell>() line 474 DocumentViewerImpl::~DocumentViewerImpl() line 295 + 22 bytes DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes DocumentViewerImpl::Release(DocumentViewerImpl * const 0x0ad4f470) line 237 + 99 bytes nsWebShell::Embed(nsWebShell * const 0x0ab20e40, nsIContentViewer * 0x0b488690, const char * 0x0b483fa0, nsISupports * 0x00000000) line 916 + 27 bytes nsDocumentBindInfo::OnStartRequest(nsDocumentBindInfo * const 0x0b486e30, nsIChannel * 0x0b486c80, nsISupports * 0x00000000) line 1945 + 36 bytes nsOnStartRequestEvent::HandleEvent(nsOnStartRequestEvent * const 0x0b489810) line 212 nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x0b489814) line 149 + 12 bytes PL_HandleEvent(PLEvent * 0x0b489814) line 509 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00f1b290) line 470 + 9 bytes _md_EventReceiverProc(HWND__ * 0x0246092e, unsigned int 49307, unsigned int 0, long 15839888) line 932 + 9 bytes USER32! 77e71250() 00f1b290()

I don't even know what the frame manager is. I'm assuming Troy might have changed something? cc'ing him.

It's really hyatt's fault (of course :-). Seems that while we're destroying the entire frame hierarchy he's calling into the frame construction code which triggers a call into the pres shell (which is in the middle of the destructor) which refernces the now destroyed frame manager

I intentionally destroyed the frame manager before destroying the frame model so we wouldn't have the overhead of removing frames from the content->frame map. I should have added a NULL pointer check in SetPrimaryFrameFor() and SetPlaceholderFrameFor(), which I carelessly forgot about so I'm adding it now

Lisa, I'm not sure why I was assigned as QA contact for this mailnews crash. Could you have one of your expert mail QA engineers check to see if this crash is fixed ?

*** Bug 11339 has been marked as a duplicate of this bug. ***

nbaca - can you verify? Thanks.

Build 1999112208M12: NT4 Verified Fixed. Also checked Linux and Mac and they do not crash either.