Steps to reproduce: 1. Run a debug Firefox build with -P to bring up profile manager. 2. Create a new profile. 3. Click the button to start Firefox with the new profile. Result: Firefox crashes while trying to restart itself. aObject passed to nsContentUtils::DropScriptObject is null. Thread 0 Crashed: 0 libgklayout.dylib 0x15442d49 nsContentUtils::DropScriptObject(unsigned, void*) + 33 (nsContentUtils.cpp:3430) 1 libgklayout.dylib 0x159ccc45 nsContentUtils::ScriptObjectHolder::~ScriptObjectHolder [in-charge]() + 29 (nsXULElement.cpp:972) 2 libgklayout.dylib 0x156e760a nsXULPrototypeScript::~nsXULPrototypeScript [in-charge deleting]() + 40 (nsXULElement.cpp:2784) 3 libgklayout.dylib 0x1599b430 nsXULPrototypeNode::Release() + 100 (nsXULElement.h:228) 4 libgklayout.dylib 0x1599b445 nsXULPrototypeNode::ReleaseSubtree() + 17 (nsXULElement.h:229) 5 libgklayout.dylib 0x159ccf2d nsXULPrototypeElement::ReleaseSubtree() + 97 (nsXULElement.h:267) 6 libgklayout.dylib 0x15607ebd nsXULPrototypeDocument::~nsXULPrototypeDocument [in-charge deleting]() + 205 (nsXULPrototypeDocument.cpp:190) 7 libgklayout.dylib 0x156058c7 nsXULPrototypeDocument::Release() + 269 (nsXULPrototypeDocument.cpp:212) 8 libgklayout.dylib 0x1599fa69 nsRefPtr<nsXULPrototypeDocument>::~nsRefPtr [in-charge]() + 37 (nsIXULContentSink.h:956) 9 libgklayout.dylib 0x15600253 nsXULDocument::~nsXULDocument [in-charge deleting]() + 1309 (nsXULDocument.cpp:268) 10 libgklayout.dylib 0x1545a0c9 nsDocument::LastRelease() + 63 (nsDocument.cpp:895) 11 libgklayout.dylib 0x1545a936 nsDocument::Release() + 266 (nsDocument.cpp:943) 12 libgklayout.dylib 0x1556b359 nsXMLDocument::Release() + 17 (nsXMLDocument.cpp:211) 13 libgklayout.dylib 0x155f257d nsXULDocument::Release() + 17 (nsXULDocument.cpp:366) 14 libnecko.dylib 0x2d46ab7a nsCOMPtr<nsIStreamLoaderObserver>::assign_assuming_AddRef(nsIStreamLoaderObserver*) + 94 (nsStreamLoader.cpp:568) 15 libnecko.dylib 0x2d46abac nsCOMPtr<nsIStreamLoaderObserver>::assign_with_AddRef(nsISupports*) + 48 (nsStreamLoader.cpp:1236) 16 libnecko.dylib 0x2d46acde nsCOMPtr<nsIStreamLoaderObserver>::operator=(nsIStreamLoaderObserver*) + 24 (nsStreamLoader.cpp:714) 17 libnecko.dylib 0x2d3ae114 nsStreamLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 210 (nsStreamLoader.cpp:112) 18 libjar50.dylib 0x2d0fc041 nsJARChannel::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 187 (nsJARChannel.cpp:753) 19 libnecko.dylib 0x2d3897d1 nsInputStreamPump::OnStateStop() + 271 (nsInputStreamPump.cpp:572) 20 libnecko.dylib 0x2d3898ef nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) + 153 (nsInputStreamPump.cpp:396) 21 libxpcom_core.dylib 0x013a841c nsInputStreamReadyEvent::Run() + 100 (nsStreamUtils.cpp:112) 22 libxpcom_core.dylib 0x0134ae9c nsThread::ProcessNextEvent(int, int*) + 556 (nsThread.cpp:483) 23 libxpcom_core.dylib 0x012f384f NS_ProcessPendingEvents_P(nsIThread*, unsigned) + 145 (nsThreadUtils.cpp:179) 24 libxpcom_core.dylib 0x012f88b7 NS_ShutdownXPCOM_P + 481 (nsXPComInit.cpp:722) 25 XUL 0x00207d01 ScopedXPCOMStartup::~ScopedXPCOMStartup [in-charge]() + 57 (nsAppRunner.cpp:778) 26 XUL 0x0020ed59 XRE_main + 5297 (nsAppRunner.cpp:2889) 27 org.mozilla.firefox 0x00002eec main + 40 (nsBrowserApp.cpp:62) 28 org.mozilla.firefox 0x00002852 _start + 216 29 org.mozilla.firefox 0x00002779 start + 41

A similar crash happens when I exit a debug build of Firefox about 50% of the time if I have Greasemonkey installed.

This fixes the crash for me. I don't know if it's the right fix.

Comment on attachment 258123 [details] [diff] [review] add null check to ScriptObjectHolder::~ScriptObjectHolder Sure. r+sr=peterv.

Fixed on trunk.