**** observed with 2000-04-17 win build on Win NT **** it happens only when Address picker is invoked from Address Book, doing from New mail composition from messenger doesn't make the failure to occur Steps to reproduce: - open Address Book: -open New Mail composition; -click on the address icon; -choose several addresses from Address picker; -click OK and note: //application crashes

*** Bug 36123 has been marked as a duplicate of this bug. ***

Mass move mailnews bugs to Putterman. Ouch.

Putting on [beta2+] radar.

I don't crash, but I get the following js exception that prevents me from hitting ok: I will look into this. line 0: uncaught exception: [Exception... "Component returned failure code: 0x8 0004003 (NS_ERROR_INVALID_POINTER) [nsIMsgCompFields.SplitRecipients]" nsresult : "0x80004003 (NS_ERROR_INVALID_POINTER)" location: "JS frame :: chrome://messe nger/content/messengercompose/addressingWidgetOverlay.js :: CompFields2Recipient s :: line 83" data: no]

forget the exception I mentioned. cc'ing ducarroz in case it's us and reassigning to rickg because I'm not sure who does html widgets. I see the crash also. It seems to be happening due to the line: in CompFields2Recipients in mailnews\compose\resources\content\addressingWidgetOverlay.js awSetInputAndPopupFromArray(msgCompFields.SplitRecipients(msgCompFields.GetTo(), false), "addr_to", newTreeChildrenNode, templateNode); nsHTMLSelectElement::GetPresState(nsHTMLSelectElement * const 0x05cd10d0, nsIPresState * * 0x0012be68, nsISupportsArray * * 0x0012be78) line 899 nsHTMLSelectElement::SetSelectedIndex(nsHTMLSelectElement * const 0x05cd10d0, int 0) line 649 + 63 bytes nsHTMLSelectElement::SetValue(nsHTMLSelectElement * const 0x05cd10d0, const nsString & {"addr_to"}) line 757 SetHTMLSelectElementProperty(JSContext * 0x05a01990, JSObject * 0x04b1d438, long -5, long * 0x0012c948) line 338 + 22 bytes js_SetProperty(JSContext * 0x05a01990, JSObject * 0x04b1d438, long 36468480, long * 0x0012c948) line 2148 + 195 bytes js_Interpret(JSContext * 0x05a01990, long * 0x0012cad0) line 2352 + 1424 bytes js_Invoke(JSContext * 0x05a01990, unsigned int 1, unsigned int 0) line 702 + 13 bytes js_Interpret(JSContext * 0x05a01990, long * 0x0012d3b4) line 2483 + 15 bytes js_Invoke(JSContext * 0x05a01990, unsigned int 1, unsigned int 2) line 702 + 13 bytes js_InternalInvoke(JSContext * 0x05a01990, JSObject * 0x04a8fca8, long 78762408, unsigned int 0, unsigned int 1, long * 0x0012d540, long * 0x0012d4e8) line 775 + 19 bytes JS_CallFunctionValue(JSContext * 0x05a01990, JSObject * 0x04a8fca8, long 78762408, unsigned int 1, long * 0x0012d540, long * 0x0012d4e8) line 2794 + 31 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x05a01db0, void * 0x04a8fca8, void * 0x04b1d1a8, unsigned int 1, void * 0x0012d540, int * 0x0012d53c) line 764 + 33 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x05b4c044) line 140 + 57 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x05b0c030, nsIDOMEvent * 0x05b4c044, unsigned int 4, unsigned int 7) line 703 + 19 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x05a93cc0, nsEvent * 0x0012da74, nsIDOMEvent * * 0x0012da3c, unsigned int 7, nsEventStatus * 0x0012dd10) line 843 + 29 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x05b0c180, nsIPresContext * 0x05a93cc0, nsEvent * 0x0012da74, nsIDOMEvent * * 0x0012da3c, unsigned int 1, nsEventStatus * 0x0012dd10) line 3296 nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 0x05b36610, nsIPresContext * 0x05a93cc0, nsMouseEvent * 0x0012de04, nsEventStatus * 0x0012dd10) line 1555 + 42 bytes nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x05b36610, nsIPresContext * 0x05a93cc0, nsGUIEvent * 0x0012de04, nsIFrame * 0x04b3888c, nsEventStatus * 0x0012dd10, nsIView * 0x05a93480) line 728 + 24 bytes PresShell::HandleEvent(PresShell * const 0x05a94d94, nsIView * 0x05a93480, nsGUIEvent * 0x0012de04, nsEventStatus * 0x0012dd10, int & 1) line 3164 + 43 bytes nsView::HandleEvent(nsView * const 0x05a93480, nsGUIEvent * 0x0012de04, unsigned int 28, nsEventStatus * 0x0012dd10, int & 1) line 811 nsViewManager2::DispatchEvent(nsViewManager2 * const 0x05a93660, nsGUIEvent * 0x0012de04, nsEventStatus * 0x0012dd10) line 1355 HandleEvent(nsGUIEvent * 0x0012de04) line 69 nsWindow::DispatchEvent(nsWindow * const 0x05a93354, nsGUIEvent * 0x0012de04, nsEventStatus & nsEventStatus_eIgnore) line 511 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012de04) line 532 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=??? y=???}) line 3236 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=??? y=???}) line 3443 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 29163840, long * 0x0012e168) line 2386 + 24 bytes nsWindow::WindowProc(HWND__ * 0x00010cc8, unsigned int 514, unsigned int 0, long 29163840) line 740 + 27 bytes USER32! 77e71820() 01

Updating [beta2+] in Status Summary to [nsbeta2+]

Reassigning to pollmann.

I can not reproduce this crash. The addressing widget no longer uses the select element that probably caused this crash. Marking WORKSFORME.

Uisng build 2000-05-16 on win98, mac and linux this works for me too. Verified