open www.hoover.com (don't ask me why anyone would want to) as the main page loads, a second window is popped up. click on the vertical scroll bar of the second window crash. stack: nsMenuBarListener::MouseDown(nsIDOMEvent * 0x037ba904) line 218 + 15 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 700 + 17 bytes nsXULDocument::HandleDOMEvent(nsXULDocument * const 0x03a20028, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 1876 nsXULElement::HandleDOMEvent(nsXULElement * const 0x03650640, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 2783 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02fcd360, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 2781 nsXULElement::HandleDOMEvent(nsXULElement * const 0x030349d0, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 2781 nsXULElement::HandleDOMEvent(nsXULElement * const 0x02f74c90, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 2781 nsXULElement::HandleDOMEvent(nsXULElement * const 0x036a5380, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 2781 nsXULElement::HandleChromeEvent(nsXULElement * const 0x036a53ac, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 3764 GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x03746d04, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 3245 nsDocument::HandleDOMEvent(nsDocument * const 0x035e5990, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 2404 nsGenericElement::HandleDOMEvent(nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 802 AnonymousElement::HandleDOMEvent(AnonymousElement * const 0x0309b75c, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus * 0x0012fa78) line 134 + 31 bytes nsGenericElement::HandleDOMEvent(nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 1, nsEventStatus * 0x0012fa78) line 792 nsXMLElement::HandleDOMEvent(nsXMLElement * const 0x03781a6c, nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus * 0x0012fa78) line 132 + 31 bytes PresShell::HandleEvent(PresShell * const 0x02e1a1a4, nsIView * 0x037815f0, nsGUIEvent * 0x0012fb6c, nsEventStatus * 0x0012fa78) line 2750 + 39 bytes nsView::HandleEvent(nsView * const 0x037815f0, nsGUIEvent * 0x0012fb6c, unsigned int 8, nsEventStatus * 0x0012fa78, int & 0) line 841 nsView::HandleEvent(nsView * const 0x0311fb00, nsGUIEvent * 0x0012fb6c, unsigned int 28, nsEventStatus * 0x0012fa78, int & 0) line 826 nsViewManager2::DispatchEvent(nsViewManager2 * const 0x0311c170, nsGUIEvent * 0x0012fb6c, nsEventStatus * 0x0012fa78) line 1002 HandleEvent(nsGUIEvent * 0x0012fb6c) line 69 nsWindow::DispatchEvent(nsWindow * const 0x02d2bd24, nsGUIEvent * 0x0012fb6c, nsEventStatus & nsEventStatus_eIgnore) line 502 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fb6c) line 523 nsWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line 3465 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line 3683 nsWindow::ProcessMessage(unsigned int 513, unsigned int 1, long 7536877, long * 0x0012fdcc) line 2750 + 24 bytes nsWindow::WindowProc(void * 0x00a60516, unsigned int 513, unsigned int 1, long 7536877) line 689 + 27 bytes

no big surprise, this happens on www.netscape.com as well. suggest a P1 priority since it's a very easy to reproduce crash, and suggest an M13 milestone.

Suggesting is fine, and in this case i agree, but in general please leave the target milestone field blank to ensure prompt triage. reassigning to evaughan

stupid required comment: really assigning to evaughan

Looks like it crashes in menubar. Your working on menus right? Seems to work ok in viewer.

Dave, why in the world do we have a menubar listener for popup windows that don't have any menus?

*** Bug 23938 has been marked as a duplicate of this bug. ***

There was a bad cast added in to nsMenuBarFrame.cpp. Fixing it averts the crash.

old bug, verified 2/11