apprunner is crashing in mozilla/layout/base/src/nsHTMLReflowState.cpp line 129. frame is uninitialized. stack trace thusly: #0 0x403ec4a4 in nsHTMLReflowState::Init (this=0xbfffc20c, aPresContext=@0x81b3f68) at ../../../../../layout/html/base/src/nsHTMLReflowState.cpp:129 #1 0x403ec461 in nsHTMLReflowState::nsHTMLReflowState (this=0xbfffc20c, aPresContext=@0x81b3f68, aParentReflowState=@0xbfffcf30, aFrame=0x0, aAvailableSpace=@0xbfffc29c) at ../../../../../layout/html/base/src/nsHTMLReflowState.cpp:117 #2 0x403dd09a in nsBlockFrame::ReflowBullet (this=0x82362c0, aState=@0xbfffcbb0, aMetrics=@0xbfffc314) at ../../../../../layout/html/base/src/nsBlockFrame.cpp:4783 #3 0x403d9925 in nsBlockFrame::PlaceLine (this=0x82362c0, aState=@0xbfffcbb0, aLine=0x823ec20, aKeepReflowGoing=0xbfffc3d4) at ../../../../../layout/html/base/src/nsBlockFrame.cpp:2918 #4 0x403d7b9a in nsBlockFrame::ReflowLine (this=0x82362c0, aState=@0xbfffcbb0, aLine=0x823ec20, aKeepReflowGoing=0xbfffc3d4) at ../../../../../layout/html/base/src/nsBlockFrame.cpp:1861 ... It goes on and on.

a bug in the block code uncovered by the toolbar code. The issue had to do with style changed reflows and assumptions about list bullets, when no bullet was around.

Marking Verified.

Moving all Apprunner bugs past and present to Other component temporarily whilst don and I set correct component. Apprunner component will be deleted/retired shortly.