To reproduce bug: 1. load a page with a simple form, like www.yahoo.com or www.netscape.com (for searches) 2. Enter in a search phrase, such as "search" 3. Press the submit button NGLayout crashes, it appears to be an event-related thing, but what do I know? Here's a stack trace: nsFrame::DisplaySelection(nsIPresContext & {...}) line 487 + 3 bytes nsFrame::HandleEvent(nsFrame * const 0x010678a0, nsIPresContext & {...}, nsGUIEvent * 0x0012f308, nsEventStatus & nsEventStatus_eIgnore) line 566 + 12 bytes nsContainerFrame::HandleEvent(nsContainerFrame * const 0x01067820, nsIPresContext & {...}, nsGUIEvent * 0x0012f308, nsEventStatus & nsEventStatus_eIgnore) line 341 nsView::HandleEvent(nsGUIEvent * 0x0012f308, unsigned int 28) line 666 nsScrollingView::HandleEvent(nsGUIEvent * 0x0012f308, unsigned int 28) line 900 + 16 bytes HandleEvent(nsGUIEvent * 0x0012f308) line 151 + 17 bytes nsWindow::DispatchEvent(nsGUIEvent * 0x0012f308) line 288 + 10 bytes nsWindow::DispatchStandardEvent(unsigned int 103) line 311 + 12 bytes nsWindow::DispatchFocus(unsigned int 103) line 1935 + 12 bytes nsWindow::ProcessMessage(unsigned int 7, unsigned int 2033148, long 0, long * 0x0012f458) line 1511 + 19 bytes nsWindow::WindowProc(void * 0x001405b6, unsigned int 7, unsigned int 2033148, long 0) line 337 + 27 bytes USER32! 77e71ab7() USER32! 77e71a77() NTDLL! 77f7624f() nsWindow::~nsWindow() line 391 nsButton::~nsButton() line 43 + 13 bytes nsButton::`scalar deleting destructor'() + 20 bytes nsObject::ReleaseObject() line 105 + 65 bytes nsObject::InnerSupport::Release(nsObject::InnerSupport * const 0x01140710) line 71 + 17 bytes nsView::~nsView() line 231 + 18 bytes nsView::`scalar deleting destructor'() + 20 bytes nsView::Destroy() line 368 + 38 bytes nsView::~nsView() line 186 + 11 bytes nsView::`scalar deleting destructor'() + 20 bytes nsView::Release(nsView * const 0x01067960) line 286 + 38 bytes nsFrame::~nsFrame() line 196 + 18 bytes nsSplittableFrame::~nsSplittableFrame() line 33 + 13 bytes nsContainerFrame::~nsContainerFrame() line 58 + 13 bytes RootContentFrame::~RootContentFrame() + 25 bytes RootContentFrame::`scalar deleting destructor'() + 20 bytes nsFrame::DeleteFrame(nsFrame * const 0x010678a0) line 254 + 38 bytes nsContainerFrame::~nsContainerFrame() line 56 RootFrame::~RootFrame() + 25 bytes RootFrame::`scalar deleting destructor'() + 20 bytes nsFrame::DeleteFrame(nsFrame * const 0x01067820) line 254 + 38 bytes PresShell::~PresShell() line 315 PresShell::`scalar deleting destructor'() + 20 bytes PresShell::Release(PresShell * const 0x010a63c0) line 279 + 32 bytes DocumentViewerImpl::~DocumentViewerImpl() line 190 + 18 bytes DocumentViewerImpl::`scalar deleting destructor'() + 20 bytes DocumentViewerImpl::Release(DocumentViewerImpl * const 0x010cb480) line 143 + 105 bytes nsWebShell::Embed(nsWebShell * const 0x01031be0, nsIContentViewer * 0x010cbd80, char * 0x00000000, nsISupports * 0x00000000) line 378 + 31 bytes nsDocumentBindInfo::OnStartBinding(nsDocumentBindInfo * const 0x010c0e20, nsIURL * 0x010c0e80, char * 0x010ca640) line 862 + 36 bytes NET_NGLayoutConverter(int 38, void * 0x00000000, URL_Struct_ * 0x010c05d0, MWContext_ * 0x010c21c0) line 660 + 32 bytes NET_StreamBuilder(int 38, URL_Struct_ * 0x010c05d0, MWContext_ * 0x010c21c0) line 239 + 24 bytes NET_CacheConverter(int 38, void * 0x00000000, URL_Struct_ * 0x010c05d0, MWContext_ * 0x010c21c0) line 1558 + 17 bytes NET_StreamBuilder(int 102, URL_Struct_ * 0x010c05d0, MWContext_ * 0x010c21c0) line 239 + 24 bytes net_setup_http_stream(_ActiveEntry * 0x010c4400) line 2878 + 22 bytes net_ProcessHTTP(_ActiveEntry * 0x010c4400) line 3536 + 9 bytes NET_ProcessNet(PRFileDesc * 0x010caec0, int 2) line 3272 + 13 bytes NET_PollSockets() line 180 + 18 bytes nsNetlibService::NetPollSocketsCallback(nsITimer * 0x010c8ca0, void * 0x01013e60) line 488 TimerImpl::Fire(unsigned long 436979873) line 319 + 17 bytes TimerImpl::ProcessTimeouts(unsigned long 436979873) line 197 FireTimeout(void * 0x00000000, unsigned int 275, unsigned int 13827, unsigned long 436979873) line 101 + 9 bytes USER32! 77e7128c() main(int 1, char * * 0x00ff51d0) line 95 mainCRTStartup() line 338 + 17 bytes KERNEL32! 77f1b304()

*** This bug has been marked as a duplicate of 312572 ***

[BugSplat #312572 := BugZilla #613.] Verified duplicate.

mid-air collision ? / bugzilla cleanup Reopening (current State: verified and no resolution)

move / marking fixed

verfy