Run apprunner, choose Editor from the tasks menu. Click in the text to place the caret. Now close the window. You crash. Stack looks like: Calling chain using A6/R1 links Back chain ISA Caller 00000000 PPC 180D8F78 0381AC40 PPC 180D7EB4 main+007BC 0381AAA0 PPC 170C52FC nsAppShellService::Run()+00020 0381AA60 PPC 170B09A0 nsAppShell::Run()+00050 0381A9E0 PPC 170B14A4 nsMacMessagePump::DoMessagePump()+00044 0381A990 PPC 170B1670 nsMacMessagePump::DispatchEvent(int, EventRecord*)+ 00084 0381A940 PPC 170B1C98 nsMacMessagePump::DoMouseDown(EventRecord&)+003E0 0381A850 PPC 170B23D0 nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort *)+0004C 0381A800 PPC 170ABCBC nsMacMessageSink::DispatchOSEvent(EventRecord&, GrafPort*)+00048 0381A7C0 PPC 170A725C nsMacWindow::HandleOSEvent(EventRecord&)+0004C 0381A760 PPC 170A764C nsMacEventHandler::HandleOSEvent(EventRecord&)+000B0 0381A710 PPC 170A852C nsMacEventHandler::HandleMouseDownEvent(EventRecord& )+00120 0381A660 PPC 1708E288 nsWindow::Destroy()+00090 0381A620 PPC 170902FC nsWindow::ReportDestroyEvent()+00074 0381A5C0 PPC 1709001C nsWindow::DispatchWindowEvent(nsGUIEvent&)+00028 0381A580 PPC 1708FF24 nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus& )+000A8 0381A530 PPC 170C6FE0 nsWebShellWindow::HandleEvent(nsGUIEvent*)+000E4 0381A4E0 PPC 170C6DF0 nsWebShellWindow::Close()+00038 0381A490 PPC 15BFC494 nsWebShell::Destroy()+000CC 0381A450 PPC 15BFB604 nsWebShell::DestroyChildren()+0006C 0381A400 PPC 15BFC47C nsWebShell::Destroy()+000B4 0381A3C0 PPC 15BF5578 DocumentViewerImpl::Release()+0006C 0381A380 PPC 15BF5860 DocumentViewerImpl::~DocumentViewerImpl()+0014C 0381A330 PPC 15BF4C5C NSGetFactory+002C0 0381A2F0 PPC 15BED494 nsCOMPtr_base::~nsCOMPtr_base()+00038 0381A2B0 PPC 157A5DAC PresShell::Release()+00088 0381A270 PPC 157A62C8 PresShell::~PresShell()+00140 0381A230 PPC 159DE438 nsRangeList::Release()+0006C 0381A1F0 PPC 159DE26C nsRangeList::~nsRangeList()+001B4 0381A190 PPC 17E1F268 nsSupportsArray::Release()+0006C 0381A150 PPC 17E1F104 nsSupportsArray::~nsSupportsArray()+0002C 0381A110 PPC 17E1F4A4 nsSupportsArray::DeleteArray()+00020 0381A0D0 PPC 17E200B0 nsSupportsArray::Clear()+00044 0381A090 PPC 16E7842C TypeInState::Release()+0006C 0381A050 PPC 16E78664 TypeInState::~TypeInState()+00068 0381A010 PPC 1705E254 operator delete(void*)+0001C 03819FB0 PPC 1705F38C free+00024 Closing log

P2, M5.

Mail compose on all platforms is affected as well. Dup bug is 5793.

Mike and I worked out a fix for this. The problem was that the editor had a member variable that was being freed.

I've got a handle on this one. With Chris H's kind permission, I'll check in the fix tonight.

I've got a handle on this one. With Chris H's kind permission, I'll check in the fix tonight.

I've got a handle on this one. With Chris H's kind permission, I'll check in the fix tonight.

fix checked in 15:45pm 4/30/99. TypeInState class ownership model fixed.

verified in 5/4 Mac build of apprunner.