I crash when I bring up the browser and type Ctrl-W to close the window: //Bubbling stage if (NS_EVENT_FLAG_CAPTURE != aFlags && mScriptGlobalObject) { => mScriptGlobalObject->HandleDOMEvent(aPresContext, aEvent, aDOMEvent, NS_EVENT_FLAG_BUBBLE, aEventStatus); } mScriptGlobalObject == 0xdddddddd (deleted) nsXULDocument::HandleDOMEvent(nsXULDocument * const 0x0237bbf0, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 1931 + 36 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x028a89d0, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 3108 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02927990, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 3102 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02927670, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 3102 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02927240, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 3102 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02928da0, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 3102 + 39 bytes nsXULElement::HandleChromeEvent(nsXULElement * const 0x02928dcc, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 4128 GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x02b47d54, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 393 nsDocument::HandleDOMEvent(nsDocument * const 0x02c1fce0, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 2482 nsGenericElement::HandleDOMEvent(nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 1027 + 39 bytes nsHTMLHtmlElement::HandleDOMEvent(nsHTMLHtmlElement * const 0x02bec83c, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 191 nsGenericElement::HandleDOMEvent(nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 1020 + 39 bytes nsHTMLBodyElement::HandleDOMEvent(nsHTMLBodyElement * const 0x02c1285c, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 715 nsGenericElement::HandleDOMEvent(nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 1020 + 39 bytes nsHTMLTableElement::HandleDOMEvent(nsHTMLTableElement * const 0x02c373ac, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 1318 nsGenericElement::HandleDOMEvent(nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 1020 + 39 bytes nsHTMLTableSectionElement::HandleDOMEvent(nsHTMLTableSectionElement * const 0x02b8b30c, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 374 nsGenericElement::HandleDOMEvent(nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 1020 + 39 bytes nsHTMLTableRowElement::HandleDOMEvent(nsHTMLTableRowElement * const 0x02c29a0c, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 739 nsGenericElement::HandleDOMEvent(nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 1020 + 39 bytes nsHTMLTableCellElement::HandleDOMEvent(nsHTMLTableCellElement * const 0x02c2b110, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000002, nsEventStatus * 0x0012fa20) line 559 nsGenericElement::HandleDOMEvent(nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x0012f81c, unsigned int 0x00000001, nsEventStatus * 0x0012fa20) line 1020 + 39 bytes nsHTMLImageElement::HandleDOMEvent(nsHTMLImageElement * const 0x02c2a2c0, nsIPresContext * 0x02beb370, nsEvent * 0x0012fab8, nsIDOMEvent * * 0x00000000, unsigned int 0x00000001, nsEventStatus * 0x0012fa20) line 479 PresShell::HandleEvent(PresShell * const 0x02b88b64, nsIView * 0x02c30a40, nsGUIEvent * 0x0012fab8, nsEventStatus * 0x0012fa20) line 2941 + 39 bytes nsView::HandleEvent(nsView * const 0x02c30a40, nsGUIEvent * 0x0012fab8, unsigned int 0x00000008, nsEventStatus * 0x0012fa20, int & 0x00000000) line 799 nsView::HandleEvent(nsView * const 0x02c2f1d0, nsGUIEvent * 0x0012fab8, unsigned int 0x00000008, nsEventStatus * 0x0012fa20, int & 0x00000000) line 784 nsView::HandleEvent(nsView * const 0x02b8b0f0, nsGUIEvent * 0x0012fab8, unsigned int 0x0000001c, nsEventStatus * 0x0012fa20, int & 0x00000000) line 784 nsViewManager2::DispatchEvent(nsViewManager2 * const 0x02b8b370, nsGUIEvent * 0x0012fab8, nsEventStatus * 0x0012fa20) line 1216 HandleEvent(nsGUIEvent * 0x0012fab8) line 69 nsWindow::DispatchEvent(nsWindow * const 0x02b88f04, nsGUIEvent * 0x0012fab8, nsEventStatus & nsEventStatus_eIgnore) line 493 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fab8) line 514 nsWindow::DispatchKeyEvent(unsigned int 0x00000083, unsigned short 0x0077, unsigned int 0x00000000) line 1890 + 15 bytes nsWindow::OnChar(unsigned int 0x00000017, unsigned int 0x00000000, unsigned char 0x00) line 1996 nsWindow::ProcessMessage(unsigned int 0x00000102, unsigned int 0x00000017, long 0x00110001, long * 0x0012fd60) line 2135 + 33 bytes nsWindow::WindowProc(HWND__ * 0x0385038a, unsigned int 0x00000102, unsigned int 0x00000017, long 0x00110001) line 671 + 27 bytes USER32! 77e71820(

[PDT+] We're not sure how to reproduce... but if you can... we'll need to fix it since Rick comments this is pretty common.

*** Bug 29588 has been marked as a duplicate of this bug. ***

i don't understand jar's comment about not being able to repro. it's xp and happens just like warren said.

reassigning.

Fixed.

Verified with 03-08-09.