Created attachment 255743 [details] testcase See testcase: - Focus the text input of the isindex element - Reload the document Result: crash It doesn't happen always, just try it another time, it happens fairly often. This regressed between 2007-02-18 and 2007-02-19: http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-02-18+05&maxdate=2007-02-19+09&cvsroot=%2Fcvsroot My guess is a regression from bug 257868 since that patch is touching isindex files.
But I guess this might be a regression from bug 368549, instead.
Backing out the patch from bug 257868 fixes this for me.
Now that I null out mInputContent in nsIsIndexFrame::Destroy, the event listener is not destroyed in the destructor. Interestingly, I can't create an auto-test for this, since it doesn't appear to be possible to focus the isindex from a script (?). I could use some help with this.
Created attachment 255770 [details] [diff] [review] patch
Created attachment 255771 [details] [diff] [review] patch