here's the stack to reproduce, start messenger select a folder or newsgroup after it loads select a different folder or newsgroup crash. here's the stack. it is easy to reproduce. #0 0x0 in ?? () #1 0x411d31ee in nsTableFrame::AdjustForCollapsingCols (this=0x8525c9c, aPresContext=0x829af90, aWidth=@0xbfffbdc4) at nsTableFrame.cpp:2181 #2 0x411d29ef in nsTableFrame::ResizeReflowPass2 (this=0x8525c9c, aPresContext=0x829af90, aDesiredSize=@0xbfffbdc4, aReflowState=@0xbfffbabc, aStatus=@0xbfffd01c) at nsTableFrame.cpp:1997 #3 0x411d1e35 in nsTableFrame::Reflow (this=0x8525c9c, aPresContext=0x829af90, aDesiredSize=@0xbfffbdc4, aReflowState=@0xbfffbd20, aStatus=@0xbfffd01c) at nsTableFrame.cpp:1647 #4 0x4120d9e5 in nsTreeFrame::Reflow (this=0x8525c9c, aPresContext=0x829af90, aDesiredSize=@0xbfffbdc4, aReflowState=@0xbfffbd20, aStatus=@0xbfffd01c) at nsTreeFrame.cpp:479 #5 0x41017705 in nsContainerFrame::ReflowChild (this=0x8525c3c, aKidFrame=0x8525c9c, aPresContext=0x829af90, aDesiredSize=@0xbfffbdc4, aReflowState=@0xbfffbd20, aX=0, aY=0, aFlags=3, aStatus=@0xbfffd01c) at nsContainerFrame.cpp:637 #6 0x411da24a in nsTableOuterFrame::IR_InnerTableReflow (this=0x8525c3c, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffc0e0, aStatus=@0xbfffd01c) at nsTableOuterFrame.cpp:610 #7 0x411d9f16 in nsTableOuterFrame::IR_ReflowDirty (this=0x8525c3c, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffc0e0, aStatus=@0xbfffd01c) at nsTableOuterFrame.cpp:517 #8 0x411da07c in nsTableOuterFrame::IR_TargetIsMe (this=0x8525c3c, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffc0e0, aStatus=@0xbfffd01c) at nsTableOuterFrame.cpp:556 #9 0x411d981d in nsTableOuterFrame::IncrementalReflow (this=0x8525c3c, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffc0e0, aStatus=@0xbfffd01c) at nsTableOuterFrame.cpp:324 #10 0x411daaca in nsTableOuterFrame::Reflow (this=0x8525c3c, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffc170, aStatus=@0xbfffd01c) at nsTableOuterFrame.cpp:840 #11 0x4120ae48 in nsTreeOuterFrame::Reflow (this=0x8525c3c, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffc170, aStatus=@0xbfffd01c) at nsTreeOuterFrame.cpp:124 #12 0x411fd044 in nsBoxFrame::FlowChildAt (this=0x8525bfc, childFrame=0x8525c3c, aPresContext=0x829af90, desiredSize=@0xbfffcd7c, aReflowState=@0xbfffc51c, aStatus=@0xbfffd01c, aInfo=@0x854be28, aRedraw=@0xbfffc41c, aReason=@0xbfffc378) at nsBoxFrame.cpp:1137 #13 0x411fc391 in nsBoxFrame::FlowChildren (this=0x8525bfc, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffc51c, aStatus=@0xbfffd01c, rect=@0xbfffc4c8) at nsBoxFrame.cpp:684 #14 0x411fc00c in nsBoxFrame::Reflow (this=0x8525bfc, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffc51c, aStatus=@0xbfffd01c) at nsBoxFrame.cpp:571 #15 0x411fd044 in nsBoxFrame::FlowChildAt (this=0x851f4bc, childFrame=0x8525bfc, aPresContext=0x829af90, desiredSize=@0xbfffcd7c, aReflowState=@0xbfffc8c8, aStatus=@0xbfffd01c, aInfo=@0x854c250, aRedraw=@0xbfffc7c8, aReason=@0xbfffc724) at nsBoxFrame.cpp:1137 #16 0x411fc391 in nsBoxFrame::FlowChildren (this=0x851f4bc, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffc8c8, aStatus=@0xbfffd01c, rect=@0xbfffc874) at nsBoxFrame.cpp:684 #17 0x411fc00c in nsBoxFrame::Reflow (this=0x851f4bc, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffc8c8, aStatus=@0xbfffd01c) at nsBoxFrame.cpp:571 #18 0x411fd044 in nsBoxFrame::FlowChildAt (this=0x850fbd0, childFrame=0x851f4bc, aPresContext=0x829af90, desiredSize=@0xbfffcd7c, aReflowState=@0xbfffccdc, aStatus=@0xbfffd01c, aInfo=@0x8550de0, aRedraw=@0xbfffcb74, aReason=@0xbfffcad0) at nsBoxFrame.cpp:1137 #19 0x411fc391 in nsBoxFrame::FlowChildren (this=0x850fbd0, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffccdc, aStatus=@0xbfffd01c, rect=@0xbfffcc20) at nsBoxFrame.cpp:684 #20 0x411fc00c in nsBoxFrame::Reflow (this=0x850fbd0, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffccdc, aStatus=@0xbfffd01c) at nsBoxFrame.cpp:571 #21 0x41017705 in nsContainerFrame::ReflowChild (this=0x850fb94, aKidFrame=0x850fbd0, aPresContext=0x829af90, aDesiredSize=@0xbfffcd7c, aReflowState=@0xbfffccdc, aX=0, aY=0, aFlags=0, aStatus=@0xbfffd01c) at nsContainerFrame.cpp:637 #22 0x4102d2d7 in RootFrame::Reflow (this=0x850fb94, aPresContext=0x829af90, aDesiredSize=@0xbfffced4, aReflowState=@0xbfffce2c, aStatus=@0xbfffd01c) at nsHTMLFrame.cpp:326 #23 0x41017705 in nsContainerFrame::ReflowChild (this=0x850fb58, aKidFrame=0x850fb94, aPresContext=0x829af90, aDesiredSize=@0xbfffced4, aReflowState=@0xbfffce2c, aX=0, aY=0, aFlags=0, aStatus=@0xbfffd01c) at nsContainerFrame.cpp:637 #24 0x41060227 in ViewportFrame::Reflow (this=0x850fb58, aPresContext=0x829af90, aDesiredSize=@0xbfffd090, aReflowState=@0xbfffcf7c, aStatus=@0xbfffd01c) at nsViewportFrame.cpp:526 #25 0x4102ea37 in nsHTMLReflowCommand::Dispatch (this=0x8735f80, aPresContext=0x829af90, aDesiredSize=@0xbfffd090, aMaxSize=@0xbfffd070, aRendContext=@0x85fb1e0) at nsHTMLReflowCommand.cpp:144 #26 0x4104b4c4 in PresShell::ProcessReflowCommands (this=0x82b03e8) at nsPresShell.cpp:1912 #27 0x41047d75 in PresShell::ExitReflowLock (this=0x82b03e8, aTryToReflow=1, aDoSynchronousReflow=1) at nsPresShell.cpp:824 #28 0x4104d063 in PresShell::ContentRemoved (this=0x82b03e8, aDocument=0x828efd8, aContainer=0x8452880, aChild=0x85b1b00, aIndexInContainer=3) at nsPresShell.cpp:2448 #29 0x40a838f0 in nsXULDocument::ContentRemoved (this=0x828efd8, aContainer=0x8452880, aChild=0x85b1b00, aIndexInContainer=3) at nsXULDocument.cpp:1539 #30 0x40a5d6b6 in nsXULElement::RemoveChildAt (this=0x8452880, aIndex=3, aNotify=1) at nsXULElement.cpp:2095 #31 0x40a720d2 in RDFGenericBuilderImpl::RemoveGeneratedContent (this=0x84fd688, aElement=0x8452880) at nsRDFGenericBuilder.cpp:2970 #32 0x40a66c40 in RDFGenericBuilderImpl::RebuildContainer (this=0x84fd688, aElement=0x8452880) at nsRDFGenericBuilder.cpp:886 #33 0x40a8c65b in nsXULDocument::RebuildWidgetItem (this=0x828efd8, aElement=0x8452880) at nsXULDocument.cpp:3984 #34 0x40a83397 in nsXULDocument::AttributeChanged (this=0x828efd8, aElement=0x8452880, aNameSpaceID=0, aAttribute=0x8294778, aHint=-1) at nsXULDocument.cpp:1416 #35 0x40a5e65c in nsXULElement::SetAttribute (this=0x8452880, aNameSpaceID=0, aName=0x8294778, aValue=@0xbfffd98c, aNotify=1) at nsXULElement.cpp:2334 #36 0x40a5a060 in nsXULElement::SetAttribute (this=0x8452880, aName=@0xbfffda24, aValue=@0xbfffd98c) at nsXULElement.cpp:1144 #37 0x40aac42d in nsXULTreeElement::SetAttribute (this=0x84d2988, aName=@0xbfffda24, aValue=@0xbfffd98c) at nsXULTreeElement.h:51 #38 0x4047a427 in ElementSetAttribute (cx=0x85e8ae8, obj=0x85a3810, argc=2, argv=0x86a98e4, rval=0xbfffdb64) at nsJSElement.cpp:263 #39 0x4008b37e in js_Invoke (cx=0x85e8ae8, argc=2, flags=0) at jsinterp.c:665 #40 0x40099af1 in js_Interpret (cx=0x85e8ae8, result=0xbfffe52c) at jsinterp.c:2226 #41 0x4008b3dd in js_Invoke (cx=0x85e8ae8, argc=4, flags=0) at jsinterp.c:681 #42 0x40099af1 in js_Interpret (cx=0x85e8ae8, result=0xbfffef20) at jsinterp.c:2226 #43 0x4008b3dd in js_Invoke (cx=0x85e8ae8, argc=1, flags=0) at jsinterp.c:681 #44 0x4097e525 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/components/libxpconnect.so #45 0x4097c122 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/components/libxpconnect.so #46 0x40183214 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libxpcom.so #47 0x401834ca in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libxpcom.so #48 0x40cc7227 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/components/libmailnews.so #49 0x40d51e52 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libmsgbaseutil.so #50 0x40d5480e in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libmsgbaseutil.so #51 0x4156ab53 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/components/libmsgimap.so #52 0x40cc647f in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/components/libmailnews.so #53 0x40cc6517 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/components/libmailnews.so #54 0x40d65a68 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libmsgbaseutil.so #55 0x4156bf19 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/components/libmsgimap.so #56 0x41586a37 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/components/libmsgimap.so #57 0x415826fb in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/components/libmsgimap.so #58 0x401db36b in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libplds3.so #59 0x401db27c in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libplds3.so #60 0x4017110c in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libxpcom.so #61 0x406afe24 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libwidget_gtk.so #62 0x406afaaf in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libwidget_gtk.so #63 0x408673ca in ?? () from /usr/lib/libglib-1.2.so.0 #64 0x40868a86 in ?? () from /usr/lib/libglib-1.2.so.0 #65 0x40869041 in ?? () from /usr/lib/libglib-1.2.so.0 #66 0x408691e1 in ?? () from /usr/lib/libglib-1.2.so.0 #67 0x407927a9 in ?? () from /usr/lib/libgtk-1.2.so.0 #68 0x406b0427 in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libwidget_gtk.so #69 0x405841dd in ?? () from /home/sspitzer/MOZILLA/06.20.1999/09.22/mozilla/dist/bin/libnsappshell.so #70 0x804bf3d in main1 (argc=1, argv=0xbffff924) at nsAppRunner.cpp:622 #71 0x804c3c7 in main (argc=1, argv=0xbffff924) at nsAppRunner.cpp:710 #72 0x402ddcb3 in ?? () from /lib/libc.so.6

marking as blocker.

as a blocker, this will keep the tree closed today until it is fixed and/or we have good traction. adding self to cc.

adding karnaze to the list because he tweaked tables last night, and may not have tested mail.

karnaze checked in a bunch of table code yesterday. Reassigning to him.

Problem also occured on WinNT 2000-13-09-M13 commercial build. Cannot get the talkback report today.

Typo! Should be WinNT 2000-01-13-09-M13 commercial build!!

Dave, reassgning since you are all over this.

Fixed.

*** Bug 23879 has been marked as a duplicate of this bug. ***

This bug is not specific for selecting/switching folder... When I replying the gif attachment mail, I got crash, too.

*** Bug 23864 has been marked as a duplicate of this bug. ***

OK using 2000-01-13-13 commercial on linux 6.0

OK using 2000-01-13-14 commercial on NT 4.0. All of the OK's were verified for switching folders and sorting thread pane. Clicking on Inbox after migration is still a problem in all platforms (bug #23864 was marked a duplicate of this) but will tackle that as a separate issue.

OK using 2000-01-13-14 commercial on mac OS 8.5.1.