select some text use the toolbar drop-down control to set the text color. get this crash: nsMenuFrame::UpdateDismissalListener(nsIMenuParent * 0x00000000) line 1106 + 3 bytes nsMenuFrame::OpenMenuInternal(int 0) line 471 + 15 bytes nsMenuFrame::AttributeChanged(nsMenuFrame * const 0x023e12f8, nsIPresContext * 0x020ae3b0, nsIContent * 0x027f54e0, nsIAtom * 0x013686c0, int 2) line 395 nsCSSFrameConstructor::AttributeChanged(nsCSSFrameConstructor * const 0x020d5410, nsIPresContext * 0x020ae3b0, nsIContent * 0x027f54e0, nsIAtom * 0x013686c0, int 2) line 6818 + 31 bytes StyleSetImpl::AttributeChanged(StyleSetImpl * const 0x020d54b0, nsIPresContext * 0x020ae3b0, nsIContent * 0x027f54e0, nsIAtom * 0x013686c0, int -1) line 918 PresShell::AttributeChanged(PresShell * const 0x020d5308, nsIDocument * 0x020ade30, nsIContent * 0x027f54e0, nsIAtom * 0x013686c0, int -1) line 1705 + 53 bytes XULDocumentImpl::AttributeChanged(XULDocumentImpl * const 0x020ade30, nsIContent * 0x027f54e0, nsIAtom * 0x013686c0, int -1) line 2152 RDFElementImpl::UnsetAttribute(RDFElementImpl * const 0x027f54e0, int 0, nsIAtom * 0x013686c0, int 1) line 2664 RDFElementImpl::RemoveAttribute(RDFElementImpl * const 0x027f54d0, const nsString & {...}) line 1231 + 31 bytes nsMenuFrame::OpenMenu(nsMenuFrame * const 0x023e2dd8, int 0) line 422 + 45 bytes nsMenuPopupFrame::DismissChain(nsMenuPopupFrame * const 0x01266810) line 628 nsMenuFrame::Execute() line 976 nsMenuFrame::HandleEvent(nsMenuFrame * const 0x022f7cb8, nsIPresContext & {...}, nsGUIEvent * 0x0012fbc8, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 246 PresShell::HandleEvent(PresShell * const 0x020d5304, nsIView * 0x029b7680, nsGUIEvent * 0x0012fbc8, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2083 + 38 bytes nsView::HandleEvent(nsView * const 0x029b7680, nsGUIEvent * 0x0012fbc8, unsigned int 8, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 828 nsView::HandleEvent(nsView * const 0x020d5a50, nsGUIEvent * 0x0012fbc8, unsigned int 28, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 813 nsViewManager::DispatchEvent(nsViewManager * const 0x020d40c0, nsGUIEvent * 0x0012fbc8, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 1667 HandleEvent(nsGUIEvent * 0x0012fbc8) line 63 nsWindow::DispatchEvent(nsWindow * const 0x020b1e44, nsGUIEvent * 0x0012fbc8, nsEventStatus & nsEventStatus_eIgnore) line 338 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbc8) line 359 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3223 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3441 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 3735582, long * 0x0012fdec) line 2457 + 24 bytes nsWindow::WindowProc(HWND__ * 0x0e490966, unsigned int 514, unsigned int 0, long 3735582) line 453 + 27 bytes

this is a reasonably common operation, and the crash happens every time. May be indicative of bigger problems, should get looked into for M11.

commented out the affected line of code, which was a work in progress, anyway.

My hands have deteriorated to the point where I can no longer type. I need help. If you think you can fix this bug on your own, please take it away from me. If you'd like to volunteer to be my hands for a specific bug, then I'll be happy to come up to your cube and sit with you and fix the bug (assuming you have the patience for that).

*** Bug 14471 has been marked as a duplicate of this bug. ***

verified old bug