See testcase, which usually crashes with current trunk build after 500ms. This seems to have regressed between 2007-01-19 and 2007-01-21: http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-07-19+03&maxdate=2007-07-21+06&cvsroot=%2Fcvsroot Regression from bug 347639, somehow? (if that makes sense) http://crash-stats.mozilla.com/report/index/ace73acc-5e5a-11dc-853f-001a4bd43ed6 0 nsLayoutUtils::GetParentOrPlaceholderFor(nsFrameManager*, nsIFrame*) mozilla/layout/base/nsLayoutUtils.cpp:1137 1 FillAncestors mozilla/layout/base/nsLayoutUtils.cpp:379 2 nsLayoutUtils::DoCompareTreePosition(nsIFrame*, nsIFrame*, int, int, nsIFrame*) mozilla/layout/base/nsLayoutUtils.cpp:415 3 nsLayoutUtils::CompareTreePosition(nsIFrame*, nsIFrame*, nsIFrame*) mozilla/layout/base/nsLayoutUtils.h:188 4 nsFrameConstructorState::ProcessFrameInsertions(nsAbsoluteItems&, nsIAtom*) mozilla/layout/base/nsCSSFrameConstructor.cpp:1504 5 nsFrameConstructorState::~nsFrameConstructorState() mozilla/layout/base/nsCSSFrameConstructor.cpp:1249 6 nsCSSFrameConstructor::ContentInserted(nsIContent*, nsIContent*, int, nsILayoutHistoryState*) mozilla/layout/base/nsCSSFrameConstructor.cpp:9184 7 nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*) mozilla/layout/base/nsCSSFrameConstructor.cpp:11080 8 nsCSSFrameConstructor::RestyleElement(nsIContent*, nsIFrame*, nsChangeHint) mozilla/layout/base/nsCSSFrameConstructor.cpp:9940 9 nsCSSFrameConstructor::ProcessOneRestyle(nsIContent*, nsReStyleHint, nsChangeHint) mozilla/layout/base/nsCSSFrameConstructor.cpp:12965 10 nsCSSFrameConstructor::ProcessPendingRestyles() mozilla/layout/base/nsCSSFrameConstructor.cpp:13018 11 PresShell::DoFlushPendingNotifications(mozFlushType, int) mozilla/layout/base/nsPresShell.cpp:4418 12 PresShell::FlushPendingNotifications(mozFlushType) mozilla/layout/base/nsPresShell.cpp:4385 13 nsGfxScrollFrameInner::AsyncScrollPortEvent::Run() mozilla/layout/generic/nsGfxScrollFrame.cpp:1878 14 nsThread::ProcessNextEvent(int, int*) mozilla/xpcom/threads/nsThread.cpp:490 15 NS_ProcessNextEvent_P(nsIThread*, int) nsThreadUtils.cpp:227 16 nsThread::Shutdown() mozilla/xpcom/threads/nsThread.cpp:445 17 NS_InvokeByIndex_P mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101 18 nsProxyObjectCallInfo::Run() mozilla/xpcom/proxy/src/nsProxyEvent.cpp:181 19 nsThread::ProcessNextEvent(int, int*) mozilla/xpcom/threads/nsThread.cpp:490

Ok, it doesn't seem to crash online, you have to download the testcase, by using right-click "Save Link Target As.." and then open it locally.

Pertinent parts of the stack: #9 0xb67a8757 in PresShell::RecreateFramesFor (this=0x8a74760, aContent=0x8a956f0) at ../../../mozilla/layout/base/nsPresShell.cpp:3313 #10 0xb6a55264 in nsObjectLoadingContent::EnsureInstantiation (this=0x8a9570c, aInstance=0xbfffd720) at ../../../../mozilla/content/base/src/nsObjectLoadingContent.cpp:654 #11 0xb6ccafa1 in nsHTMLPluginObjElementSH::GetPluginInstance (this=0x8ad2d70, wrapper=0x8ad3038, _result=0xbfffd720) at ../../../../mozilla/dom/src/base/nsDOMClassInfo.cpp:8511 #12 0xb6ccb0fe in nsHTMLPluginObjElementSH::PostCreate (this=0x8ad2d70, wrapper=0x8ad3038, cx=0x8986588, obj=0x8a923a0) at ../../../../mozilla/dom/src/base/nsDOMClassInfo.cpp:8551 #13 0xb71b1ae3 in XPCWrappedNative::GetNewOrUsed (ccx=@0xbfffd930, Object=0x8a956f0, Scope=0x89b0aa0, Interface=0x81389e0, isGlobal=0, resultWrapper=0xbfffd8cc) at ../../../../../mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:522 ... #16 0xb6c1228d in nsXBLProtoImpl::InitTargetObjects (this=0x8a98bb0, aBinding=0x8ab5790, aContext=0x898b970, aBoundElement=0x8a956f0, aScriptObjectHolder=0xbfffdac0, aTargetClassObject=0xbfffdabc) at ../../../../mozilla/content/xbl/src/nsXBLProtoImpl.cpp:129 ... #20 0xb6c1bbc8 in nsXBLService::LoadBindings (this=0x84dd658, aContent=0x8a956f0, aURL=0x8a7a340, aOriginPrincipal=0x855d2b8, aAugmentFlag=0, aBinding=0xbfffddb0, aResolveStyle=0xbfffdda8) at ../../../../mozilla/content/xbl/src/nsXBLService.cpp:590 #21 0xb6743b9c in nsCSSFrameConstructor::ConstructFrameInternal (this=0x8a75ad8, aState=@0xbfffe240, aContent=0x8a956f0, aParentFrame=0x8ad0544, aTag=0x809adc0, aNameSpaceID=0, aStyleContext=0x8ad130c, aFrameItems=@0xbfffdfa8, aXBLBaseTag=0) at ../../../mozilla/layout/base/nsCSSFrameConstructor.cpp:7532 So basically more or less exactly the situation in bug 394970.

Fixed by patch in bug 345711

Verified fixed, using: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a9pre) Gecko/2007102605 Minefield/3.0a9pre

Oops, I verified the bug with a build that didn't contain the fix for bug 345711 yet. I guess this was already worksforme before that, then.