Created attachment 331510 Stack: frame destruction during ScrollPointIntoView
The problem is that nsViewManager::Composite() flushes pending notifications and thus destroys arbitrary layout objects. http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/generic/nsSelection.cpp&rev=3.311&root=/cvsroot&mark=5549,5553#5543 (in this case the whole shell, and thus all its frames and their views - one of the views we're currently scrolling on the call stack)
Created attachment 331510
Stack: frame destruction during ScrollPointIntoView
The problem is that nsViewManager: :Composite( ) flushes pending notifications bonsai. mozilla. org/cvsblame. cgi?file= mozilla/ layout/ generic/ nsSelection. cpp&rev= 3.311&root= /cvsroot& mark=5549, 5553#5543
and thus destroys arbitrary layout objects.
http://
(in this case the whole shell, and thus all its frames and their views -
one of the views we're currently scrolling on the call stack)