See upcoming testcase, which crashes on reload. Talkback ID: TB15157663M This regressed between 2005-07-19 and 2005-07-20: http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-07-19+06&maxdate=2005-07-20+07&cvsroot=%2Fcvsroot Maybe bug 295690 or bug 297850?

Backtrace from debug build (I finally managed to get a working build again). First, an assertion: #1 0x6ff445a3 in Break(char const*) ( aMsg=0x22dec8 "###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFl ow', file c:/mozilla/mozilla/layout/generic/nsPlaceholderFrame.h, line 121") at c:/mozilla/mozilla/xpcom/base/nsDebugImpl.cpp:434 #2 0x6ff44300 in NS_DebugBreak_P (aSeverity=1, aStr=0x503ffc0 "Null out-of-flow for placeholder?", aExpr=0x503ffa5 "outOfFlow", aFile=0x503ff00 "c:/mozilla/mozilla/layout/generic/nsPlaceholderFrame.h", aLine=121) at c:/mozilla/mozilla/xpcom/base/nsDebugImpl.cpp:351 #3 0x057216e7 in nsPlaceholderFrame::GetRealFrameForPlaceholder(nsIFrame*) ( aFrame=0x1049f060) at c:/mozilla/mozilla/layout/generic/nsPlaceholderFrame.h:121 Then the crash itself: Program received signal SIGSEGV, Segmentation fault. 0x057bfb81 in nsIFrame::GetStyleData(nsStyleStructID) const (this=0x0, aSID=eStyleStruct_Display) at c:/mozilla/mozilla/layout/generic/nsIFrame.h:574 574 NS_ASSERTION(mStyleContext, "No style context found!"); Current language: auto; currently c++ (gdb) bt #0 0x057bfb81 in nsIFrame::GetStyleData(nsStyleStructID) const (this=0x0, aSID=eStyleStruct_Display) at c:/mozilla/mozilla/layout/generic/nsIFrame.h:574 #1 0x057bfdad in nsIFrame::GetStyleDisplay() const (this=0x0) at c:/mozilla/mozilla/layout/style/nsStyleStructList.h:90 #2 0x050370c7 in DoDeletingFrameSubtree(nsPresContext*, nsFrameManager*, nsVoid Array&, nsIFrame*, nsIFrame*) (aPresContext=0x1005de68, aFrameManager=0x103f91cc, aDestroyQueue=@0x22e388, aRemovedFrame=0x1049ee84, aFrame=0x1049ee84) at c:/mozilla/mozilla/layout/base/nsCSSFrameConstructor.cpp:9842 #3 0x05037352 in DeletingFrameSubtree(nsPresContext*, nsFrameManager*, nsIFrame *) (aPresContext=0x1005de68, aFrameManager=0x103f91cc, aFrame=0x1049ee84) at c:/mozilla/mozilla/layout/base/nsCSSFrameConstructor.cpp:9897

Fixing bug 282173 will fix this.

WFM on Mac and Windows, using builds from before BuildFloatList removal but not more than two weeks old. Martijn, do you still see this crash?

(In reply to comment #4) > Martijn, do you still see this crash? No, tested with 2006-04-10 build, so marking wfm.

This got fixed on trunk in the range: http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=MozillaTinderboxAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-03-24+06&maxdate=2006-03-25+10&cvsroot=%2Fcvsroot Likely by bug 330456.