On about 5% of loads, this testcase triggers three assertions and a crash. If it is loaded locally, it crashes reliably within a minute (because it reloads itself). ###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockReflowState.cpp, line 735 ###!!! ASSERTION: mOriginalDisplay has not been properly initialized: 'mStyleDisplay->mOriginalDisplay != NS_STYLE_DISPLAY_NONE', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 829 ###!!! ASSERTION: Should hit cbrs->frame before we run off the frame tree!: 'aContainingBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1014 Thread 0 Crashed: 0 nsIFrame::GetPositionIgnoringScrolling + 15 (nsHTMLReflowState.cpp:668) 1 nsHTMLReflowState::CalculateHypotheticalBox + 1222 (nsHTMLReflowState.cpp:1015) 2 nsHTMLReflowState::InitAbsoluteConstraints + 407 (nsHTMLReflowState.cpp:1070) 3 nsHTMLReflowState::InitConstraints + 1576 (nsHTMLReflowState.cpp:1756) 4 nsHTMLReflowState::Init + 308 (nsHTMLReflowState.cpp:288) 5 nsHTMLReflowState::nsHTMLReflowState[in-charge] + 969 (nsHTMLReflowState.cpp:181) 6 nsBlockFrame::ReflowFloat + 473 (nsBlockFrame.cpp:5275) 7 nsBlockReflowState::FlowAndPlaceFloat + 406 (nsBlockReflowState.cpp:741) 8 nsBlockReflowState::AddFloat + 380 (nsBlockReflowState.cpp:546) 9 nsLineLayout::AddFloat + 49 (nsLineLayout.cpp:256) 10 nsLineLayout::ReflowFrame + 1437 (nsLineLayout.cpp:925) 11 nsBlockFrame::ReflowInlineFrame + 105 (nsBlockFrame.cpp:3432) 12 nsBlockFrame::DoReflowInlineFrames + 692 (nsBlockFrame.cpp:3252) ...

I can't crash this testcase... does it still crash for you?

WFM on trunk (even without your patch for bug 387201).

Oops, the testcase was calling location.reload() every 5ms and not successfully reloading (when loaded from Bugzilla) as a result.

I let it go for a few minutes and it didn't crash :)

Crashtest checked in (without the self-reloading, of course).