Using code checked out on 28 May 1999, I am getting a SEGV when closing the preferences window. I looked at the code and the problem seems to be caused by dereferencing an uninitialized pointer: #0 0x6be6093c in nsDocument::HandleDOMEvent (this=0x110f348, aPresContext=@0x12445f8, aEvent=0xefffb2f0, aDOMEvent=0xefffb278, aFlags=4, aEventStatus=@0xefffb320) at ../../../../mozilla/layout/base/src/nsDocument.cpp:2271 2266 } 2267 2268 //Capturing stage 2269 if (NS_EVENT_FLAG_BUBBLE != aFlags) { 2270 nsIScriptGlobalObject* mGlobal; 2271 > if (NS_OK == mScriptContextOwner->GetScriptGlobalObject(&mGlobal)) { 2272 mGlobal->HandleDOMEvent(aPresContext, aEvent, aDOMEvent, NS_EVENT_FLAG_CAPTURE, aEventStatus); 2273 NS_RELEASE(mGlobal); 2274 } 2275 } (gdb) p mScriptContextOwner $11 = (nsIScriptContextOwner *) 0x0 As you can see mScriptContextOwner is NULL.

crashes for me in Win98 too (M6 talkback release) APPRUNNER caused an invalid page fault in module <unknown> at 0000:7fc69e61. Registers: EAX=7fc69e61 CS=015f EIP=7fc69e61 EFLGS=00010202 EBX=00000000 SS=0167 ESP=006900f0 EBP=006903a0 ECX=00000000 DS=0167 ESI=8170dfb0 FS=5caf EDX=c002fb0c ES=0167 EDI=81702bb4 GS=0000 Bytes at CS:EIP: Stack dump: bff9d770 006903e4 00403d90 008b0f80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000

What do you mean by closing? Clicking on cancel (which always crashes for me in win98) or clicking on the close icon on the dialog?

Well, prefs don't even come up post-Necko. This bug (if it still exists) will have to wait for the dust to settle.

Both hitting the "Cancel" button and closing via the window manager work for me in the 8/16/1999 build. Closing the bug with a WORKSFORME resolution. Please reopen if there's something more I need to do to trigger the bug.

Working fine. Marking verified.