I'm not sure if I'm assigning this to the right area but it looks like it is in some window code. Assuming this isn't a dup, I nominate it for dogfood. I was reading the mailnews newsgroup and clicking the Next button after reading each message. After doing this for about 4 messages I get the following crash: nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012a214) line 31 + 23 bytes nsCOMPtr<nsIContent>::assign_from_helper(const nsCOMPtr_helper & {...}, const nsID & {...}) line 768 + 18 bytes nsCOMPtr<nsIContent>::nsCOMPtr<nsIContent>(const nsCOMPtr_helper & {...}) line 497 GlobalWindowImpl::GetPrivateParent(GlobalWindowImpl * const 0x033a68e8, nsPIDOMWindow * * 0x0012a334) line 3479 nsXULCommandDispatcher::GetControllerForCommand(nsXULCommandDispatcher * const 0x02844f20, const nsString & {"button_delete"}, nsIController * * 0x0012a418) line 513 XULCommandDispatcherGetControllerForCommand(JSContext * 0x02784b50, JSObject * 0x03026de8, unsigned int 1, long * 0x03f38b9c, long * 0x0012a4d4) line 437 + 23 bytes js_Invoke(JSContext * 0x02784b50, unsigned int 1, unsigned int 0) line 665 + 26 bytes js_Interpret(JSContext * 0x02784b50, long * 0x0012ad44) line 2226 + 15 bytes js_Invoke(JSContext * 0x02784b50, unsigned int 1, unsigned int 0) line 681 + 13 bytes js_Interpret(JSContext * 0x02784b50, long * 0x0012b570) line 2226 + 15 bytes js_Invoke(JSContext * 0x02784b50, unsigned int 1, unsigned int 2) line 681 + 13 bytes js_InternalCall(JSContext * 0x02784b50, JSObject * 0x03026df0, long 50490872, unsigned int 1, long * 0x0012b6f4, long * 0x0012b6a0) line 758 + 15 bytes JS_CallFunctionValue(JSContext * 0x02784b50, JSObject * 0x03026df0, long 50490872, unsigned int 1, long * 0x0012b6f4, long * 0x0012b6a0) line 2752 + 29 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x02784ce0, void * 0x03026df0, void * 0x03026df8, unsigned int 1, void * 0x0012b6f4, int * 0x0012b6f0) line 547 + 33 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x04ee47d4) line 128 + 57 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0328d830, nsIDOMEvent * 0x04ee47d4, unsigned int 32) line 651 + 19 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x02781f10, nsEvent * 0x0012bd08, nsIDOMEvent * * 0x0012bba8, unsigned int 7, nsEventStatus * 0x0012bd28) line 1405 + 31 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x0328d960, nsIPresContext * 0x02781f10, nsEvent * 0x0012bd08, nsIDOMEvent * * 0x0012bba8, unsigned int 1, nsEventStatus * 0x0012bd28) line 2675 nsXULCommandDispatcher::UpdateCommands(nsXULCommandDispatcher * const 0x02844f20, const nsString & {"tree-select"}) line 293 XULCommandDispatcherUpdateCommands(JSContext * 0x02784b50, JSObject * 0x03026de8, unsigned int 1, long * 0x03f38b54, long * 0x0012bf78) line 387 + 19 bytes js_Invoke(JSContext * 0x02784b50, unsigned int 1, unsigned int 0) line 665 + 26 bytes js_Interpret(JSContext * 0x02784b50, long * 0x0012c7e8) line 2226 + 15 bytes js_Invoke(JSContext * 0x02784b50, unsigned int 1, unsigned int 2) line 681 + 13 bytes js_InternalCall(JSContext * 0x02784b50, JSObject * 0x02f35b08, long 49430472, unsigned int 1, long * 0x0012c96c, long * 0x0012c918) line 758 + 15 bytes JS_CallFunctionValue(JSContext * 0x02784b50, JSObject * 0x02f35b08, long 49430472, unsigned int 1, long * 0x0012c96c, long * 0x0012c918) line 2752 + 29 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x02784ce0, void * 0x02f35b08, void * 0x02f23fc8, unsigned int 1, void * 0x0012c96c, int * 0x0012c968) line 547 + 33 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x04ef45e4) line 128 + 57 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0346c210, nsIDOMEvent * 0x04ef45e4, unsigned int 8) line 651 + 19 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x02781f10, nsEvent * 0x0012ce80, nsIDOMEvent * * 0x0012ce20, unsigned int 7, nsEventStatus * 0x0012cea0) line 1140 + 31 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x032b09d0, nsIPresContext * 0x02781f10, nsEvent * 0x0012ce80, nsIDOMEvent * * 0x0012ce20, unsigned int 1, nsEventStatus * 0x0012cea0) line 2675 nsXULTreeElement::FireOnSelectHandler(nsXULTreeElement * const 0x037ab65c) line 380 nsXULTreeElement::ClearItemSelection(nsXULTreeElement * const 0x037ab658) line 179 XULTreeElementClearItemSelection(JSContext * 0x02784b50, JSObject * 0x02f35b08, unsigned int 0, long * 0x03f38b30, long * 0x0012d058) line 336 + 15 bytes js_Invoke(JSContext * 0x02784b50, unsigned int 0, unsigned int 0) line 665 + 26 bytes js_Interpret(JSContext * 0x02784b50, long * 0x0012d8c8) line 2226 + 15 bytes js_Invoke(JSContext * 0x02784b50, unsigned int 2, unsigned int 0) line 681 + 13 bytes js_Interpret(JSContext * 0x02784b50, long * 0x0012e0f4) line 2226 + 15 bytes js_Invoke(JSContext * 0x02784b50, unsigned int 2, unsigned int 0) line 681 + 13 bytes js_Interpret(JSContext * 0x02784b50, long * 0x0012e920) line 2226 + 15 bytes js_Invoke(JSContext * 0x02784b50, unsigned int 0, unsigned int 0) line 681 + 13 bytes js_Interpret(JSContext * 0x02784b50, long * 0x0012f14c) line 2226 + 15 bytes js_Invoke(JSContext * 0x02784b50, unsigned int 1, unsigned int 2) line 681 + 13 bytes js_InternalCall(JSContext * 0x02784b50, JSObject * 0x02eb6978, long 50492376, unsigned int 1, long * 0x0012f2d0, long * 0x0012f27c) line 758 + 15 bytes JS_CallFunctionValue(JSContext * 0x02784b50, JSObject * 0x02eb6978, long 50492376, unsigned int 1, long * 0x0012f2d0, long * 0x0012f27c) line 2752 + 29 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x02784ce0, void * 0x02eb6978, void * 0x030273d8, unsigned int 1, void * 0x0012f2d0, int * 0x0012f2cc) line 547 + 33 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x04ef4c64) line 128 + 57 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x032ad720, nsIDOMEvent * 0x04ef4c64, unsigned int 4) line 651 + 19 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x02781f10, nsEvent * 0x0012f7bc, nsIDOMEvent * * 0x0012f784, unsigned int 7, nsEventStatus * 0x0012fa74) line 786 + 25 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x032ad850, nsIPresContext * 0x02781f10, nsEvent * 0x0012f7bc, nsIDOMEvent * * 0x0012f784, unsigned int 1, nsEventStatus * 0x0012fa74) line 2675 nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 0x03496e70, nsIPresContext * 0x02781f10, nsMouseEvent * 0x0012fb68, nsEventStatus * 0x0012fa74) line 1363 + 42 bytes nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x03496e70, nsIPresContext * 0x02781f10, nsGUIEvent * 0x0012fb68, nsIFrame * 0x02eef114, nsEventStatus * 0x0012fa74, nsIView * 0x02d8f290) line 561 + 24 bytes PresShell::HandleEvent(PresShell * const 0x02d90b74, nsIView * 0x02d8f290, nsGUIEvent * 0x0012fb68, nsEventStatus * 0x0012fa74) line 2577 + 43 bytes nsView::HandleEvent(nsView * const 0x02d8f290, nsGUIEvent * 0x0012fb68, unsigned int 28, nsEventStatus * 0x0012fa74, int & 0) line 841 nsViewManager::DispatchEvent(nsViewManager * const 0x02d8f7a0, nsGUIEvent * 0x0012fb68, nsEventStatus * 0x0012fa74) line 1678 HandleEvent(nsGUIEvent * 0x0012fb68) line 69 nsWindow::DispatchEvent(nsWindow * const 0x02d8f164, nsGUIEvent * 0x0012fb68, nsEventStatus & nsEventStatus_eIgnore) line 421 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fb68) line 442 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=??? y=???}) line 3332 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=??? y=???}) line 3550 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 2621723, long * 0x0012fdc8) line 2632 + 24 bytes nsWindow::WindowProc(HWND__ * 0x075503ee, unsigned int 514, unsigned int 0, long 2621723) line 608 + 27 bytes USER32! 77e71820() MOZREG! 0028011b()

assigning to danm as p1 for m12

The next message button might not be important. I got the exact same crash when reading mail in my inbox. I was just clicking on a message, reading it and clicking on another one. After a few messages I got the same crash.

Putting on the PDT+ radar.

I filed http://bugzilla.mozilla.org/show_bug.cgi?id=21400 this morning, some core functionality got whacked I'm guessing.

Adding saari and hyatt. /be

needs estimated fix date.

I'm not able to reproduce this with today's build, and I could do it pretty easily on Friday. In fact none of the random crashes I was getting on Friday are occurring. So either someone fixed them or someone introduced a leak that is hiding them. Either way, I'll mark this works for me and reopen it if it happens again.

Based on putterman's (now ancient) last comment (12/10/1999), verifying as WORKSFORME (I assume you haven't noticed this crash in the past three months).