Ubuntu
firefox-3.0 package

  1. Bug #320459
  2. Comment #3

Comment 3 for bug 320459

Revision history for this message
In , Mats Palmgren (matspal) wrote :

Created attachment 331510
Stack: frame destruction during ScrollPointIntoView

The problem is that nsViewManager::Composite() flushes pending notifications
and thus destroys arbitrary layout objects.
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/generic/nsSelection.cpp&rev=3.311&root=/cvsroot&mark=5549,5553#5543
(in this case the whole shell, and thus all its frames and their views -
one of the views we're currently scrolling on the call stack)