See testcase, which crashes with current trunk build on reload. This regressed on trunk between 2008-01-09 and 2008-01-10: http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2008-01-09+04&maxdate=2008-01-10+06&cvsroot=%2Fcvsroot Regression from bug 404146 or bug 404192 http://crash-stats.mozilla.com/report/index/e2985d57-d6a1-11dc-ae09-001a4bd43ef6 0 @0x25a161f 1 nsStyleContext::Release() nsStyleContext.h:92 2 nsFrame::~nsFrame() mozilla/layout/generic/nsFrame.cpp:350 3 nsAreaFrame::`scalar deleting destructor'(unsigned int) 4 nsFrame::Destroy() mozilla/layout/generic/nsFrame.cpp:510 5 nsContainerFrame::Destroy() mozilla/layout/generic/nsContainerFrame.cpp:299 6 nsBlockFrame::Destroy() mozilla/layout/generic/nsBlockFrame.cpp:314 7 nsFrameList::DestroyFrames() mozilla/layout/generic/nsFrameList.cpp:67 8 nsContainerFrame::Destroy() mozilla/layout/generic/nsContainerFrame.cpp:257 9 nsFrameList::DestroyFrames() mozilla/layout/generic/nsFrameList.cpp:67 10 nsContainerFrame::Destroy() mozilla/layout/generic/nsContainerFrame.cpp:257 11 nsFrameList::DestroyFrames() mozilla/layout/generic/nsFrameList.cpp:67 12 nsContainerFrame::Destroy() mozilla/layout/generic/nsContainerFrame.cpp:257 13 nsFrameManager::Destroy() mozilla/layout/base/nsFrameManager.cpp:283 14 PresShell::Destroy() mozilla/layout/base/nsPresShell.cpp:1673 15 DocumentViewerImpl::Destroy() mozilla/layout/base/nsDocumentViewer.cpp:1522 16 DocumentViewerImpl::Show() mozilla/layout/base/nsDocumentViewer.cpp:1842 17 nsPresContext::EnsureVisible(int) mozilla/layout/base/nsPresContext.cpp:1449 18 PresShell::UnsuppressAndInvalidate() mozilla/layout/base/nsPresShell.cpp:4247 19 PresShell::UnsuppressPainting() mozilla/layout/base/nsPresShell.cpp:4307 20 DocumentViewerImpl::LoadComplete(unsigned int) mozilla/layout/base/nsDocumentViewer.cpp:1013 21 nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, unsigned int) mozilla/docshell/base/nsDocShell.cpp:5031 22 nsWebShell::EndPageLoad(nsIWebProgress*, nsIChannel*, unsigned int) mozilla/docshell/base/nsWebShell.cpp:1013 23 nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, unsigned int) mozilla/docshell/base/nsDocShell.cpp:4931

Crashes calling 0xdddddddd for me on Mac.

It doesn't crash on branch.

I just changed "display: -moz-initial" to "display: inline" to improve clarity and compatibility.

Does the patch in bug 431705 fix this?

That seems very likely, yes. The testcase uses -moz-box-ordinal-group and my latest local patch makes the crash go away - I'll dig a little deeper looking at the frame trees to be sure... I'll have the new patch ready for review in a day or two.

Still crashes, using: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080905031348 Minefield/3.1b1pre

I am adding this to our "Top Security Bugs" list. Please treat this as a top priority.

FYI, bug 431705 contains fix + crashtest for this, will land after beta2.

Fixed by bug 431705. Holding the crashtest until Firefox 3.0.x is fixed.

Marking fixed1.9.0.6 for verification because bug 431705 has landed on cvs-trunk.

not for 1.8.0

Verified for 1.9.0.6 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.6pre) Gecko/2009010504 GranParadiso/3.0.6pre.

Verified fix on Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20090122 Shiretoko/3.1b3pre and Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090122 Minefield/3.2a1pre In the testcase, any reason why the perimeter of the box area does not stretch fully across the screen on trunk? It's maximized on branch.