Click on a message header to read it. Click on the message pane to put focus there (e.g. to scroll). Click on the next message in the thread pane, to read it. Hit down-arrow hoping that it's bound to "next message" (someone told me it works on some platforms). Boom! It's repeatable, but may be dependant on which messages you read and in what order you click on panes (it doesn't happen every time I hit down arrow). #0 0x4119cf18 in nsTreeRowGroupFrame::IsTableRowFrame (frame=0x4132a2d8) at nsTreeRowGroupFrame.cpp:412 #1 0x411a01cd in nsTreeRowGroupFrame::ContinueReflow (this=0x8b18678, aFrame=0x4132a2d8, aPresContext=0x88f0c60, y=-1073744960, height=136192256) at nsTreeRowGroupFrame.cpp:1340 #2 0x411a17a6 in nsTreeRowGroupFrame::IndexOfRow (this=0x8b185e8, aPresContext=0x85b9ae0, aRowContent=0x8b177e0, aRowIndex=@0xbffff3d8) at nsTreeRowGroupFrame.cpp:1772 #3 0x4119ae1d in nsTreeFrame::HandleEvent (this=0x880b4a0, aPresContext=0x85b9ae0, aEvent=0xbffff6f0, aEventStatus=0xbffff5f0) at nsTreeFrame.cpp:259 #4 0x4119949a in nsTreeOuterFrame::HandleEvent (this=0x880b444, aPresContext=0x85b9ae0, aEvent=0xbffff6f0, aEventStatus=0xbffff5f0) at nsTreeOuterFrame.cpp:100 #5 0x40fca318 in PresShell::HandleEvent (this=0x84c0a18, aView=0x84c61d0, aEvent=0xbffff6f0, aEventStatus=0xbffff5f0) at nsPresShell.cpp:2950 #6 0x4142d889 in nsView::HandleEvent (this=0x84c61d0, event=0xbffff6f0, aEventFlags=28, aStatus=0xbffff5f0, aHandled=@0xbffff594) at nsView.cpp:798 #7 0x4143f9d3 in nsViewManager2::DispatchEvent (this=0x85d63d8, aEvent=0xbffff6f0, aStatus=0xbffff5f0) at nsViewManager2.cpp:1214 #8 0x4142aef4 in HandleEvent (aEvent=0xbffff6f0) at nsView.cpp:68 #9 0x407ceb36 in nsWidget::DispatchEvent (this=0x84c0918, aEvent=0xbffff6f0, aStatus=@0xbffff68c) at nsWidget.cpp:1363 #10 0x407ce75c in nsWidget::DispatchWindowEvent (this=0x84c0918, event=0xbffff6f0) at nsWidget.cpp:1254 #11 0x407cc2ab in nsWidget::OnInput (this=0x84c0918, aEvent=@0xbffff6f0) at nsWidget.cpp:95 #12 0x407d2f6f in nsWidget::OnKey (this=0x84c0918, aEvent=@0xbffff6f0) at nsWidget.h:190 #13 0x407c0541 in handle_key_press_event (w=0x0, event=0x81e4680, p=0x84c0918) at nsGtkEventHandler.cpp:807

Adding crash keyword and suggesting beta1 since people will probably try to do this.

I have a fix in hand. Mark it PDT+, and I'll go for it.

Putting on PDT+ radar for beta1.

fixed. same fix as 26618.

Linux (2000-02-23-08 M14) Win32 (2000-02-23-09 M14) Mac (2000-02-23-12 M14) Steps to re-test 1. Click on a message header to read it 2. Click on the message pane and drag the scroll bar. 3. Click on the next message in the thread pane, to read 4. Hit down-arrow Yes. that it's bound to "next message" This works on all 3 platforms. No crash.