It's a null pointer crash because "aChild" is null: nsHTMLReflowState::DetermineFrameType(nsIPresContext & {...}) line 33 + 16 bytes nsHTMLReflowState::Init(nsIPresContext & {...}) line 235 nsHTMLReflowState::nsHTMLReflowState(nsIPresContext & {...}, nsIFrame * 0x00000000, const nsHTMLReflowState & {...}, const nsSize & {width=0x00002910 height=0x0000000c}) line 370 nsHTMLFramesetFrame::ReflowPlaceChild(nsIFrame * 0x00000000, nsIPresContext & {...}, const nsHTMLReflowState & {...}, nsPoint & {x=0x00000000 y=0x0000031f}, nsSize & {width=0x00002910 height=0x0000000c}, nsFramesetDrag * 0x00000000, nsPoint * 0x00000000 {x=??? y=???}) line 675 nsHTMLFramesetFrame::Reflow(nsHTMLFramesetFrame * const 0x0174a1c0, nsIPresContext & {...}, nsFramesetDrag * 0x00000000, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0x00000000) line 1057 nsHTMLFramesetFrame::Reflow(nsHTMLFramesetFrame * const 0x0174a1c4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0x00000000) line 832 nsContainerFrame::ReflowChild(nsIFrame * 0x0174a1c0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0x00000000) line 437 + 28 bytes RootFrame::Reflow(RootFrame * const 0x0174aa74, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0x00000000) line 147 PresShell::ResizeReflow(PresShell * const 0x01744d10, int 0x00002910, int 0x00002cac) line 567 PresShell::ResizeReflow(PresShell * const 0x01744d14, nsIView * 0x01743430, int 0x00002910, int 0x00002cac) line 1010

Verified fixed.