*Reloading* the testcase triggers a bunch of assertions. Closing the testcase in other ways, such as closing the tab or loading another page in the same tab, does not trigger them. ###!!! ASSERTION: Can't find placeholder!: 'isValid', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 936 ###!!! ASSERTION: Found placeholder in wrong block!: 'iter.GetContainer() == blockFrame', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 937 ###!!! ASSERTION: Some objects allocated with AllocateFrame were not freed: 'mFrameCount == 0', file /Users/jruderman/trunk/mozilla/layout/base/nsPresShell.cpp, line 673 This bug appears to be exploitable.

sg:critical bugs _should_ block the 1.9 release, although some have been moved to 1.9.0.x.

Moving to tracking - we'll take a fix as soon as we got one..

Who can own this bug?

WFM on trunk.

On 1.9.0.6pre I only see ###!!! ASSERTION: Adding child where we already have a child? This will likely misbehave: 'Error', file /Users/daniel/dev/ff3/mozilla/docshell/shistory/src/nsSHEntry.cpp, line 599

tomcat, can you verify this fix on debug 191branch build if you get a chance? Thanks!

verified fixed 1.9.1 using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20090201 Firefox/3.1b3pre I only see the assertion from comment #5