Hi Warren, Yeah, I just tried selecting something from the bookmarks menu (on Mac) and I see that too. (Interesting stack trace.) I can try and debug this tonight unless Chris has an idea about it... Chris? Robert Warren Harris wrote: Sorry, I meant bookmarks, not history. Warren Harris wrote: Robert, I've notice that when I select entries from the history menu, I sometimes crash with the stack trace below, and sometimes nothing happens. Are you seeing this? Warren NTDLL! 77f6cc66() NTDLL! 77f67456() js_SuspendThread(JSThinLock * 0x0192bbdc) line 332 + 12 bytes js_Enqueue(JSThinLock * 0x0192bbdc, long 12336368) line 591 + 9 bytes js_Lock(JSThinLock * 0x0192bbdc, long 12336368) line 620 + 13 bytes js_LockScope1(JSContext * 0x00c58a50, JSScope * 0x0192bbb8, long 12336368) line 673 + 13 bytes js_LockObj(JSContext * 0x00c58a50, JSObject * 0x0192bba8) line 741 + 17 bytes js_SetProperty(JSContext * 0x00c58a50, JSObject * 0x0192bba8, long 33485072, long * 0x0012eeb8) line 1922 + 13 bytes js_Interpret(JSContext * 0x00c58a50, long * 0x0012f038) line 2160 + 806 bytes js_Invoke(JSContext * 0x00c58a50, unsigned int 1, int 0) line 666 + 13 bytes js_Interpret(JSContext * 0x00c58a50, long * 0x0012f7cc) line 2183 + 15 bytes js_Invoke(JSContext * 0x00c58a50, unsigned int 1, int 0) line 666 + 13 bytes js_CallFunctionValue(JSContext * 0x00c58a50, JSObject * 0x0192c338, long 26395456, unsigned int 1, long * 0x0012f8e8, long * 0x0012f8f0) line 735 + 15 bytes JS_CallFunctionValue(JSContext * 0x00c58a50, JSObject * 0x0192c338, long 26395456, unsigned int 1, long * 0x0012f8e8, long * 0x0012f8f0) line 2371 + 29 bytes nsJSEventListener::ProcessEvent(nsIDOMEvent * 0x020f3e80) line 97 + 34 bytes nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012fafc, nsIDOMEvent * * 0x0012fa90, nsEventStatus & nsEventStatus_eIgnore) line 324 + 17 bytes RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x02104410, nsIPresContext & {...}, nsEvent * 0x0012fafc, nsIDOMEvent * * 0x0012fa90, unsigned int 2, nsEventStatus & nsEventStatus_eIgnore) line 2144 RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x021489c0, nsIPresContext & {...}, nsEvent * 0x0012fafc, nsIDOMEvent * * 0x0012fa90, unsigned int 2, nsEventStatus & nsEventStatus_eIgnore) line 2146 + 39 bytes RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x02164350, nsIPresContext & {...}, nsEvent * 0x0012fafc, nsIDOMEvent * * 0x0012fa90, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 2146 + 39 bytes nsXULCommand::DoCommand(nsXULCommand * const 0x02169e40) line 174 + 56 bytes nsXULCommand::MenuSelected(const nsMenuEvent & {...}) line 206 nsMenuItem::MenuSelected(const nsMenuEvent & {...}) line 305 nsWindow::ProcessMessage(unsigned int 273, unsigned int 112, long 0, long * 0x0012fe60) line 1703 nsWindow::WindowProc(HWND__ * 0x013b07d4, unsigned int 273, unsigned int 112, long 0) line 467 + 27 bytes

The only other clue that I have is that Purify says we're leaking ~4K of memory each time we set up an event listener: maybe something is bogus with the way we're setting up event handlers or something.

Accepted bug to get of terry's spambot.

Set target milestone to M5.

I haven't seen this crash or heard complaints about it for ages, so I'm going to guess it was sunspots or something. Marking as WORKSFORME.

works for me too.