This bug was really tricky for me to find so I'll try to be extra careful while describing it. I first saw the bug in an JavaScript emulation that emulates a small part of the Internet Explorer DHTML Object Model. To see the bug try http://webfx.nu/dhtml/ieemu/genmove.ieemu.html and move the layers around (using the mouse) for a while (~10 seconds). After a lots of tests I came to the conclusion that all one had to do was add an event listener for mouse move and move the mouse A LOT. The less javascript code that is being evaluated the more one has to move the mouse. This makes me think that maybe it is not a bug in the event system but in the javascript interpreter. The following code crashes mozilla. Notice that you have to move the mouse for a while (about a minute or more). document.addEventListener("mousemove", function (e) { true; }, false); The code makes Moz crash if the event listener is using capture as well. Another thing that might help to figure out what is going on is to open up the task manager and then you'll see that the memory is leaking when the mouse moves over the document. The first few seconds while the mouse pointer is moving the memory seems to be constant but after a while a few more kb are being used. If you see this you will get a crash in Mozilla (not directly though). Just continue to move the mouse pointer and after a while every little mouse move makes more memory become used by Moz. Finally leading to a crash. The crash does not give any error message (Dr. Watson) in Win2k. It just shuts Mozilla down entirely. userAgent string: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; 0.8) Gecko/20010213

Phil, would you see if JS is implicated?

Just tested this in the BeOS build (x86) and the crash occurs there as well. Using build 2001021912

I was unable to reproduce this on WinNT and Linux with builds from 2001-03-12, 2001-03-13. However, that may not mean the bug has gone away... It is not likely this is a JS Engine issue. Rather, I think this bug is another manifestation of bug 31847 - "Need to solve problem of JS roots for event handler funcs"

I see that bug 31847 was resolved fixed on 2001-03-11. Perhaps that explains why I was unable to reproduce this bug. d96erik@dtek.chalmers.se: could you try this bug again with a new build? If everything works OK now, we can resolve this bug as a duplicate of bug 31847; thanks -

Wow. The test case does not leak any memory and does not lead to a crash any more. My original emulation suite does not crash Mozilla any more eother. It still leaks memory and I'll try to find where and report a new bug for that. This one seems to be fixed and working fine now. Thank you.

OK - thanks! I'm going to resolve this bug as a duplicate of bug 31847. *** This bug has been marked as a duplicate of 31847 ***

Verified dup.