I'm suddenly getting a lot of these crashes during shutdown (in automated testing). I haven't found a way to reproduce at will. I'm guessing the regression is due to bug 372769, which made lots of changes to XBL, including changes to how XBL participates in cycle collection. Thread 0 Crashed: 0 nsXBLPrototypeBinding::GetImmediateChild(nsIAtom*) + 22 (nsXBLPrototypeBinding.cpp:821) 1 nsXBLBinding::ChangeDocument(nsIDocument*, nsIDocument*) + 130 (nsXBLBinding.cpp:1035) 2 nsXBLBinding::ChangeDocument(nsIDocument*, nsIDocument*) + 87 (nsXBLBinding.cpp:1032) 3 nsXBLBinding::ChangeDocument(nsIDocument*, nsIDocument*) + 87 (nsXBLBinding.cpp:1032) 4 nsXBLBinding::ChangeDocument(nsIDocument*, nsIDocument*) + 87 (nsXBLBinding.cpp:1032) 5 nsBindingManager::ChangeDocumentFor(nsIContent*, nsIDocument*, nsIDocument*) + 231 (nsBindingManager.cpp:509) 6 nsGenericElement::UnbindFromTree(int, int) + 238 (nsGenericElement.cpp:2095) 7 nsXULElement::UnbindFromTree(int, int) + 95 (nsXULElement.cpp:828) 8 nsGenericElement::UnbindFromTree(int, int) + 554 (nsGenericElement.cpp:2128) 9 nsXULElement::UnbindFromTree(int, int) + 95 (nsXULElement.cpp:828) 10 nsGenericElement::cycleCollection::Unlink(void*) + 331 (nsGenericElement.cpp:3344) 11 nsCycleCollector::CollectWhite(GCGraph&) + 649 (nsCycleCollector.cpp:1478) 12 nsCycleCollector::Collect(unsigned) + 377 (nsCycleCollector.cpp:2155) 13 nsCycleCollector::Shutdown() + 35 (nsCycleCollector.cpp:2216) 14 nsCycleCollector_shutdown() + 40 (nsCycleCollector.cpp:2618) 15 NS_ShutdownXPCOM_P + 857 (nsXPComInit.cpp:787) 16 ScopedXPCOMStartup::~ScopedXPCOMStartup [in-charge]() + 57 (nsAppRunner.cpp:873) 17 XRE_main + 6661 (nsAppRunner.cpp:3180) 18 main + 708 (nsBrowserApp.cpp:153) 19 _start + 216 20 start + 41

Patch in bug 398083 should fix this.

Seems to be gone :)