System: Nightly of 20000305 on WinNT 4 SP 6 a on PII Overview: Changing prefs multiple times crashes mozilla with a stack overflow in nsTextFormatter::vsprintf_append. Test Case: Open browser. Go to Edit->Preferences->Debug. Disable memory cache and press OK. Repeat to re-enable memory cache and press OK again. Expected Result: Normal closure of window. Actual Result: Crash (See attached crash log) Other info: Works fine in M14 though the browser window gets minimized every time after clicking OK.

*** Bug 27824 has been marked as a duplicate of this bug. ***

Open prefs change any pref hit ok open prefs change any pref hit ok crash Mcafee, Can you debug this? I can help you. nsStr::Compare(const nsStr & {...}, const nsStr & {...}, int -1, int 0) line 610 + 37 bytes nsString::Equals(const nsString & {...}, int 0, int -1) line 1888 + 69 bytes nsString::operator==(const nsString & {...}) line 1831 + 23 bytes nsStringKey::Equals(const nsHashKey * 0x00c9c4d0) line 278 _hashKeyCompare(const void * 0x0003310c, const void * 0x00c9c4d0) line 38 PL_HashTableRawLookup(PLHashTable * 0x00c844f0, unsigned int 2189529655, const void * 0x0003310c) line 181 + 28 bytes PL_HashTableLookup(PLHashTable * 0x00c844f0, const void * 0x0003310c) line 344 + 17 bytes nsHashtable::Get(nsHashKey * 0x0003310c) line 168 + 15 bytes nsComponentManagerImpl::ProgIDToClassID(nsComponentManagerImpl * const 0x00c84950, const char * 0x100b3924, nsID * 0x000331d4) line 1149 + 18 bytes nsComponentManager::ProgIDToClassID(const char * 0x100b3924, nsID * 0x000331d4) line 59 nsServiceManagerImpl::GetService(nsServiceManagerImpl * const 0x00c84cc0, const char * 0x100b3924, const nsID & {...}, nsISupports * * 0x00033244, nsIShutdownListener * 0x00000000) line 429 + 13 bytes nsServiceManager::GetService(const char * 0x100b3924, const nsID & {...}, nsISupports * * 0x00033244, nsIShutdownListener * 0x00000000) line 545 nsGetServiceByProgID::operator()(const nsID & {...}, void * * 0x00033244) line 63 + 22 bytes nsCOMPtr<nsIObserverService>::assign_from_helper(const nsCOMPtr_helper & {...}, const nsID & {...}) line 795 + 18 bytes nsCOMPtr<nsIObserverService>::nsCOMPtr<nsIObserverService>(const nsCOMPtr_helper & {...}) line 498 nsEventQueueImpl::NotifyObservers(const char * 0x100b3718) line 166 + 33 bytes nsEventQueueImpl::~nsEventQueueImpl() line 84 nsEventQueueImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes nsEventQueueImpl::Release(nsEventQueueImpl * const 0x03c24f70) line 139 + 120 bytes nsCOMPtr<nsIEventQueue>::~nsCOMPtr<nsIEventQueue>() line 435 nsAppShellService::Observe(nsAppShellService * const 0x01017cf4, nsISupports * 0x03c24f70, const unsigned short * 0x000334a4, const unsigned short * 0x00000000) line 759 nsObserverService::Notify(nsObserverService * const 0x01017530, nsISupports * 0x03c24f70, const unsigned short * 0x000334a4, const unsigned short * 0x00000000) line 241 nsEventQueueImpl::NotifyObservers(const char * 0x100b3718) line 169 nsEventQueueImpl::~nsEventQueueImpl() line 84 nsEventQueueImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes nsEventQueueImpl::Release(nsEventQueueImpl * const 0x03c24f70) line 139 + 120 bytes nsCOMPtr<nsIEventQueue>::~nsCOMPtr<nsIEventQueue>() line 435 nsAppShellService::Observe(nsAppShellService * const 0x01017cf4, nsISupports * 0x03c24f70, const unsigned short * 0x000336ac, const unsigned short * 0x00000000) line 759 nsObserverService::Notify(nsObserverService * const 0x01017530, nsISupports * 0x03c24f70, const unsigned short * 0x000336ac, const unsigned short * 0x00000000) line 241

*** Bug 30673 has been marked as a duplicate of this bug. ***

PDT+. Must stop crash.

Ugh. This is bad.

I cannot reproduce with commercial 3/7 bits (NT), mjudge cannot reproduce with current debug build. still looking

this is wfm too on mac, linux and winNT [2000.03.08.xx, opt comm bits]. we are thus marking as wfm.

biswapesh_chatterjee, is this still a problem for you with a recent build? gonna verify this, but do reopen if you see it again.

Yup, this seems fine now. Thanks, sairuh.