From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux 2.4.0-test5 i586; en-US; m17) Gecko/20000713 BuildID: nighlty build july 13th Bad: Mozilla crashes when typing http://www.schiphol.nl and then rejecting all cookies Reproducible: Always Steps to Reproduce: 1.Turn on "Warn before accepting a cookie" 2.Go to http://www.schiphol.nl 3.Reject the cookie and "remember the decision" Actual Results: Crash Expected Results: not-crash

Confirmed on 2000071720 on Linux.

Adding crash keyword

OK, this crashes me too. tested with 071808 mozilla win32 bits on NT4. over to cookies.

Asssertion Traceback NTDLL! 77f76274() nsDebug::Assertion(const char * 0x01d305b8, const char * 0x01d30590, const char * 0x01d30558, int 859) line 246 + 13 bytes nsDebug::PreCondition(const char * 0x01d305b8, const char * 0x01d30590, const char * 0x01d30558, int 859) line 342 + 21 bytes nsHTMLReflowState::InitAbsoluteConstraints(nsIPresContext * 0x0364c590, const nsHTMLReflowState * 0x00127500, int 1073741824, int 1073741824) line 859 + 35 bytes nsHTMLReflowState::InitConstraints(nsIPresContext * 0x0364c590, int 1073741824, int 1073741824) line 1762 nsHTMLReflowState::Init(nsIPresContext * 0x0364c590, int -1, int -1) line 183 nsHTMLReflowState::nsHTMLReflowState(nsIPresContext * 0x0364c590, const nsHTMLReflowState & {...}, nsIFrame * 0x03a5adb0, const nsSize & {...}, int -1, int -1) line 164 nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame * 0x03a5ae68, nsIPresContext * 0x0364c590, const nsHTMLReflowState & {...}, int -1, int -1, nsIFrame * 0x03a5adb0, nsReflowReason eReflowReason_Initial, unsigned int & 27128927) line 396 nsAbsoluteContainingBlock::Reflow(nsIFrame * 0x03a5ae68, nsIPresContext * 0x0364c590, const nsHTMLReflowState & {...}, int -1, int -1, nsRect & {...}) line 215 nsPositionedInlineFrame::Reflow(nsPositionedInlineFrame * const 0x03a5ae68, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1118 + 44 bytes nsLineLayout::ReflowFrame(nsIFrame * 0x03a5ae68, nsIFrame * * 0x0012833c, unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 982 nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineLayout & {...}, nsLineBox * 0x03a5aee0, nsIFrame * 0x03a5ae68, unsigned char * 0x001278a4) line 4364 + 29 bytes nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & {...}, nsLineLayout & {...}, nsLineBox * 0x03a5aee0, int * 0x00127f34, unsigned char * 0x00127d7c, int 0, int 0) line 4248 + 28 bytes nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState & {...}, nsLineBox * 0x03a5aee0, int * 0x00127f34, unsigned char * 0x00127d7c, int 0, int 0) line 4184 + 42 bytes nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & {...}, nsLineBox * 0x03a5aee0, int * 0x00127f34, int 0, int 0) line 4127 + 32 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x03a5aee0, int * 0x00127f34, int 0) line 3262 + 29 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2951 + 27 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x03a5ad28, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1756 + 15 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5ad28, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableCellFrame::Reflow(nsTableCellFrame * const 0x03a5accc, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 823 nsContainerFrame::ReflowChild(nsIFrame * 0x03a5accc, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableRowFrame::InitialReflow(nsTableRowFrame * const 0x03a5ac84, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, RowReflowState & {...}, unsigned int & 0, nsTableCellFrame * 0x00000000, int 1) line 1147 + 42 bytes nsTableRowFrame::Reflow(nsTableRowFrame * const 0x03a5ac84, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1604 + 35 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5ac84, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableRowGroupFrame::ReflowMappedChildren(nsTableRowGroupFrame * const 0x03a5ac40, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, RowGroupReflowState & {...}, unsigned int & 0, nsTableRowFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1, int 0) line 413 + 45 bytes nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x03a5ac40, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1088 + 38 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5ac40, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableFrame::ResizeReflowPass1(nsTableFrame * const 0x03a5abd8, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0, nsTableRowGroupFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1) line 1775 nsTableFrame::Reflow(nsTableFrame * const 0x03a5abd8, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1573 + 39 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5abd8, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 3, unsigned int & 0) line 693 + 31 bytes nsTableOuterFrame::OuterReflowChild(nsTableOuterFrame * const 0x03a5ab84, nsIPresContext * 0x0364c590, nsIFrame * 0x03a5abd8, const nsHTMLReflowState & {...}, nsHTMLReflowMetrics & {...}, int * 0x00000000, nsSize & {...}, nsMargin & {...}, nsMargin & {...}, nsReflowReason eReflowReason_Initial, unsigned int & 0) line 885 + 47 bytes nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x03a5ab84, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1419 + 59 bytes nsBlockReflowContext::DoReflowBlock(nsHTMLReflowState & {...}, nsReflowReason eReflowReason_Initial, nsIFrame * 0x03a5ab84, const nsRect & {...}, int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 519 + 36 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x03a5ab84, const nsRect & {...}, int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 344 + 50 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x0289adc4, int * 0x00129900) line 3880 + 56 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x0289adc4, int * 0x00129900, int 0) line 3144 + 23 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2951 + 27 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x03a5aafc, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1756 + 15 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5aafc, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableCellFrame::Reflow(nsTableCellFrame * const 0x03a5aaa0, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 823 nsContainerFrame::ReflowChild(nsIFrame * 0x03a5aaa0, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 15, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableRowFrame::InitialReflow(nsTableRowFrame * const 0x03a5a9b0, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, RowReflowState & {...}, unsigned int & 0, nsTableCellFrame * 0x00000000, int 1) line 1147 + 42 bytes nsTableRowFrame::Reflow(nsTableRowFrame * const 0x03a5a9b0, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1604 + 35 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5a9b0, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableRowGroupFrame::ReflowMappedChildren(nsTableRowGroupFrame * const 0x03a5a394, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, RowGroupReflowState & {...}, unsigned int & 0, nsTableRowFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1, int 0) line 413 + 45 bytes nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x03a5a394, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1088 + 38 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5a394, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableFrame::ResizeReflowPass1(nsTableFrame * const 0x03a5a32c, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0, nsTableRowGroupFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1) line 1775 nsTableFrame::Reflow(nsTableFrame * const 0x03a5a32c, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1573 + 39 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5a32c, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 3, unsigned int & 0) line 693 + 31 bytes nsTableOuterFrame::OuterReflowChild(nsTableOuterFrame * const 0x03a5a2d8, nsIPresContext * 0x0364c590, nsIFrame * 0x03a5a32c, const nsHTMLReflowState & {...}, nsHTMLReflowMetrics & {...}, int * 0x00000000, nsSize & {...}, nsMargin & {...}, nsMargin & {...}, nsReflowReason eReflowReason_Initial, unsigned int & 0) line 885 + 47 bytes nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x03a5a2d8, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1419 + 59 bytes nsBlockReflowContext::DoReflowBlock(nsHTMLReflowState & {...}, nsReflowReason eReflowReason_Initial, nsIFrame * 0x03a5a2d8, const nsRect & {...}, int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 519 + 36 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x03a5a2d8, const nsRect & {...}, int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 344 + 50 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x0289c2a4, int * 0x0012b2cc) line 3880 + 56 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x0289c2a4, int * 0x0012b2cc, int 0) line 3144 + 23 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2951 + 27 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x03a5a250, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1756 + 15 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5a250, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableCellFrame::Reflow(nsTableCellFrame * const 0x03a5a1f4, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 823 nsContainerFrame::ReflowChild(nsIFrame * 0x03a5a1f4, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableRowFrame::InitialReflow(nsTableRowFrame * const 0x03a5a1ac, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, RowReflowState & {...}, unsigned int & 0, nsTableCellFrame * 0x00000000, int 1) line 1147 + 42 bytes nsTableRowFrame::Reflow(nsTableRowFrame * const 0x03a5a1ac, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1604 + 35 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5a1ac, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableRowGroupFrame::ReflowMappedChildren(nsTableRowGroupFrame * const 0x03a5a168, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, RowGroupReflowState & {...}, unsigned int & 0, nsTableRowFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1, int 0) line 413 + 45 bytes nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x03a5a168, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1088 + 38 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x03a5a168, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes nsTableFrame::ResizeReflowPass1(nsTableFrame * const 0x02828390, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0, nsTableRowGroupFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1) line 1775 nsTableFrame::Reflow(nsTableFrame * const 0x02828390, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1573 + 39 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x02828390, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 3, unsigned int & 0) line 693 + 31 bytes nsTableOuterFrame::OuterReflowChild(nsTableOuterFrame * const 0x0282833c, nsIPresContext * 0x0364c590, nsIFrame * 0x02828390, const nsHTMLReflowState & {...}, nsHTMLReflowMetrics & {...}, int * 0x00000000, nsSize & {...}, nsMargin & {...}, nsMargin & {...}, nsReflowReason eReflowReason_Initial, unsigned int & 0) line 885 + 47 bytes nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x0282833c, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1419 + 59 bytes nsBlockReflowContext::DoReflowBlock(nsHTMLReflowState & {...}, nsReflowReason eReflowReason_Initial, nsIFrame * 0x0282833c, const nsRect & {...}, int 0, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 519 + 36 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x0282833c, const nsRect & {...}, int 0, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 344 + 50 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x028f9184, int * 0x0012cc98) line 3880 + 56 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x028f9184, int * 0x0012cc98, int 0) line 3144 + 23 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2951 + 27 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x02828278, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1756 + 15 bytes nsBlockReflowContext::DoReflowBlock(nsHTMLReflowState & {...}, nsReflowReason eReflowReason_Initial, nsIFrame * 0x02828278, const nsRect & {...}, int 0, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 519 + 36 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x02828278, const nsRect & {...}, int 0, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 344 + 50 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x028f9238, int * 0x0012d7f0) line 3880 + 56 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x028f9238, int * 0x0012d7f0, int 1) line 3144 + 23 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2951 + 27 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x028281a0, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1756 + 15 bytes nsBlockReflowContext::DoReflowBlock(nsHTMLReflowState & {...}, nsReflowReason eReflowReason_Incremental, nsIFrame * 0x028281a0, const nsRect & {...}, int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 519 + 36 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x028281a0, const nsRect & {...}, int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 344 + 50 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x02828214, int * 0x0012e348) line 3880 + 56 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x02828214, int * 0x0012e348, int 1) line 3144 + 23 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2951 + 27 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x02828118, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1756 + 15 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x02828118, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes CanvasFrame::Reflow(CanvasFrame * const 0x02827444, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 306 nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState & {...}, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0, int 0, int 0, int 6915, int 4875, int 1) line 813 nsBoxToBlockAdaptor::DoLayout(nsBoxToBlockAdaptor * const 0x028280b0, nsBoxLayoutState & {...}) line 484 + 52 bytes nsBox::Layout(nsBox * const 0x028280b0, nsBoxLayoutState & {...}) line 1002 nsScrollBoxFrame::DoLayout(nsScrollBoxFrame * const 0x0282755c, nsBoxLayoutState & {...}) line 377 nsBox::Layout(nsBox * const 0x0282755c, nsBoxLayoutState & {...}) line 1002 nsContainerBox::LayoutChildAt(nsBoxLayoutState & {...}, nsIBox * 0x0282755c, const nsRect & {...}) line 593 + 16 bytes nsGfxScrollFrameInner::LayoutBox(nsBoxLayoutState & {...}, nsIBox * 0x0282755c, const nsRect & {...}) line 1003 + 17 bytes nsGfxScrollFrameInner::Layout(nsBoxLayoutState & {...}) line 1086 nsGfxScrollFrame::DoLayout(nsGfxScrollFrame * const 0x028274b8, nsBoxLayoutState & {...}) line 1011 + 15 bytes nsBox::Layout(nsBox * const 0x028274b8, nsBoxLayoutState & {...}) line 1002 nsBoxFrame::Reflow(nsBoxFrame * const 0x02827480, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 728 nsGfxScrollFrame::Reflow(nsGfxScrollFrame * const 0x02827480, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 719 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x02827480, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes ViewportFrame::Reflow(ViewportFrame * const 0x02827408, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 546 nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x03926bc0, nsIPresContext * 0x0364c590, nsHTMLReflowMetrics & {...}, const nsSize & {...}, nsIRenderingContext & {...}) line 145 PresShell::ProcessReflowCommands(int 0) line 4199 PresShell::FlushPendingNotifications(PresShell * const 0x0369d110) line 3298 PresShell::DidCauseReflow() line 4149 PresShell::ContentAppended(PresShell * const 0x0369d118, nsIDocument * 0x0364fe80, nsIContent * 0x03774988, int 0) line 3401 nsDocument::ContentAppended(nsDocument * const 0x0364fe80, nsIContent * 0x03774988, int 0) line 1805 nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x0364fe80, nsIContent * 0x03774988, int 0) line 1179 HTMLContentSink::NotifyAppend(nsIContent * 0x03774988, int 0) line 4346 SinkContext::FlushTags(int 1) line 1984 HTMLContentSink::CloseBody(HTMLContentSink * const 0x03648470, const nsIParserNode & {...}) line 2795 CNavDTD::CloseBody(const nsIParserNode * 0x0254c7c0) line 2916 + 31 bytes CNavDTD::CloseContainer(const nsIParserNode * 0x0254c7c0, nsHTMLTag eHTMLTag_body, int 0) line 3232 + 12 bytes CNavDTD::CloseContainersTo(int 1, nsHTMLTag eHTMLTag_body, int 0) line 3289 + 20 bytes CNavDTD::CloseContainersTo(nsHTMLTag eHTMLTag_body, int 0) line 3446 + 20 bytes CNavDTD::DidBuildModel(CNavDTD * const 0x036ad580, unsigned int 0, int 1, nsIParser * 0x0364ae00, nsIContentSink * 0x03648470) line 564 nsParser::DidBuildModel(unsigned int 0) line 1385 + 60 bytes nsParser::ResumeParse(int 1, int 0) line 1910 nsParser::EnableParser(int 1) line 1492 + 15 bytes HTMLContentSink::ResumeParsing() line 4449 + 19 bytes HTMLContentSink::OnStreamComplete(HTMLContentSink * const 0x03648474, nsIStreamLoader * 0x03769a90, nsISupports * 0x00000000, unsigned int 0, unsigned int 1370, const char * 0x028e9028) line 4646 + 11 bytes nsStreamLoader::OnStopRequest(nsStreamLoader * const 0x03769a94, nsIChannel * 0x03769720, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 120 + 78 bytes nsHTTPFinalListener::OnStopRequest(nsHTTPFinalListener * const 0x037693c0, nsIChannel * 0x03769720, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 1195 + 42 bytes InterceptStreamListener::OnStopRequest(InterceptStreamListener * const 0x037646c0, nsIChannel * 0x03769720, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 1156 nsHTTPChannel::ResponseCompleted(nsIStreamListener * 0x037646c0, unsigned int 0, const unsigned short * 0x00000000) line 1732 + 36 bytes nsHTTPServerListener::OnStopRequest(nsHTTPServerListener * const 0x03762300, nsIChannel * 0x036e0214, nsISupports * 0x03769720, unsigned int 0, const unsigned short * 0x00000000) line 722 nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x03744e00) line 302 nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x03745060) line 97 + 12 bytes PL_HandleEvent(PLEvent * 0x03745060) line 587 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x010de880) line 528 + 9 bytes _md_EventReceiverProc(HWND__ * 0x061d0520, unsigned int 49469, unsigned int 0, long 17688704) line 1043 + 9 bytes USER32! 77e71268() 010de880() Crash Traceback nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 34 + 13 bytes nsAbsoluteContainingBlock::DestroyFrames(nsIFrame * 0x03a5ae68, nsIPresContext * 0x0364c590) line 365 nsPositionedInlineFrame::Destroy(nsPositionedInlineFrame * const 0x03a5ae68, nsIPresContext * 0x0364c590) line 945 nsLineBox::DeleteLineList(nsIPresContext * 0x0364c590, nsLineBox * 0x03a5aee0) line 252 nsBlockFrame::Destroy(nsBlockFrame * const 0x03a5ad28, nsIPresContext * 0x0364c590) line 1220 + 16 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5accc, nsIPresContext * 0x0364c590) line 98 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5ac84, nsIPresContext * 0x0364c590) line 98 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5ac40, nsIPresContext * 0x0364c590) line 98 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5abd8, nsIPresContext * 0x0364c590) line 98 nsTableFrame::Destroy(nsTableFrame * const 0x03a5abd8, nsIPresContext * 0x0364c590) line 264 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5ab84, nsIPresContext * 0x0364c590) line 98 nsTableOuterFrame::Destroy(nsTableOuterFrame * const 0x03a5ab84, nsIPresContext * 0x0364c590) line 64 nsLineBox::DeleteLineList(nsIPresContext * 0x0364c590, nsLineBox * 0x0289ad9c) line 252 nsBlockFrame::Destroy(nsBlockFrame * const 0x03a5aafc, nsIPresContext * 0x0364c590) line 1220 + 16 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5aaa0, nsIPresContext * 0x0364c590) line 98 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5a9b0, nsIPresContext * 0x0364c590) line 98 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5a394, nsIPresContext * 0x0364c590) line 98 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5a32c, nsIPresContext * 0x0364c590) line 98 nsTableFrame::Destroy(nsTableFrame * const 0x03a5a32c, nsIPresContext * 0x0364c590) line 264 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5a2d8, nsIPresContext * 0x0364c590) line 98 nsTableOuterFrame::Destroy(nsTableOuterFrame * const 0x03a5a2d8, nsIPresContext * 0x0364c590) line 64 nsLineBox::DeleteLineList(nsIPresContext * 0x0364c590, nsLineBox * 0x0289c27c) line 252 nsBlockFrame::Destroy(nsBlockFrame * const 0x03a5a250, nsIPresContext * 0x0364c590) line 1220 + 16 bytes nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5a1f4, nsIPresContext * 0x0364c590) line 98 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5a1ac, nsIPresContext * 0x0364c590) line 98 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x03a5a168, nsIPresContext * 0x0364c590) line 98 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x02828390, nsIPresContext * 0x0364c590) line 98 nsTableFrame::Destroy(nsTableFrame * const 0x02828390, nsIPresContext * 0x0364c590) line 264 nsFrameList::DestroyFrames(nsIPresContext * 0x0364c590) line 36 nsContainerFrame::Destroy(nsContainerFrame * const 0x0282833c, nsIPresContext * 0x0364c590) line 98 nsTableOuterFrame::Destroy(nsTableOuterFrame * const 0x0282833c, nsIPresContext * 0x0364c590) line 64 nsLineBox::DeleteLineList(nsIPresContext * 0x0364c590, nsLineBox * 0x028f915c) line 252 nsBlockFrame::Destroy(nsBlockFrame * const 0x02828278, nsIPresContext * 0x0364c590) line 1220 + 16 bytes nsLineBox::DeleteLineList(nsIPresContext * 0x0364c590, nsLineBox * 0x028f9210) line 252 nsBlockFrame::Destroy(nsBlockFrame * const 0x028281a0, nsIPresContext * 0x0364c590) line 1220 + 16 bytes nsLineBox::DeleteLineList(nsIPresContext * 0x0364c590, nsLineBox * 0x028281ec) line 252 nsBlockFrame::Destroy(nsBlockFrame * const 0x02828118, nsIPresContext * 0x0364c590) line 1220 + 16 bytes nsFrameList::DestroyFrame(nsIPresContext * 0x0364c590, nsIFrame * 0x02828118) line 122 CanvasFrame::RemoveFrame(CanvasFrame * const 0x02827444, nsIPresContext * 0x0364c590, nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x02828118) line 212 FrameManager::RemoveFrame(FrameManager * const 0x036adba0, nsIPresContext * 0x0364c590, nsIPresShell & {...}, nsIFrame * 0x02827444, nsIAtom * 0x00000000, nsIFrame * 0x02828118) line 707 nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x0369d480, nsIPresContext * 0x0364c590, nsIContent * 0x00000000, nsIContent * 0x036480d8, int 0) line 9458 + 58 bytes StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x0369d540, nsIPresContext * 0x0364c590, nsIContent * 0x00000000, nsIContent * 0x036480d8, int 0) line 1114 PresShell::ContentRemoved(PresShell * const 0x0369d118, nsIDocument * 0x0364fe80, nsIContent * 0x00000000, nsIContent * 0x036480d8, int 0) line 3440 + 53 bytes nsDocument::ContentRemoved(nsDocument * const 0x0364fe80, nsIContent * 0x00000000, nsIContent * 0x036480d8, int 0) line 1868 nsHTMLDocument::ContentRemoved(nsHTMLDocument * const 0x0364fe80, nsIContent * 0x00000000, nsIContent * 0x036480d8, int 0) line 1236 nsDocument::Reset(nsIChannel * 0x03523ba0, nsILoadGroup * 0x030da540) line 875 nsHTMLDocument::Reset(nsIChannel * 0x03523ba0, nsILoadGroup * 0x030da540) line 345 + 16 bytes nsHTMLDocument::OpenCommon(nsIURI * 0x03506fa0) line 1927 + 32 bytes nsHTMLDocument::Open(nsHTMLDocument * const 0x0364ff68, JSContext * 0x030dc6d0, long * 0x02912d1c, unsigned int 1) line 2004 + 18 bytes nsHTMLDocument::ScriptWriteCommon(JSContext * 0x030dc6d0, long * 0x02912d1c, unsigned int 1, int 0) line 2128 + 40 bytes nsHTMLDocument::Write(nsHTMLDocument * const 0x0364ff68, JSContext * 0x030dc6d0, long * 0x02912d1c, unsigned int 1) line 2167 NSHTMLDocumentWrite(JSContext * 0x030dc6d0, JSObject * 0x0287eb60, unsigned int 1, long * 0x02912d1c, long * 0x0012e34c) line 868 + 35 bytes js_Invoke(JSContext * 0x030dc6d0, unsigned int 1, unsigned int 0) line 716 + 23 bytes js_Interpret(JSContext * 0x030dc6d0, long * 0x0012ec88) line 2517 + 15 bytes js_Invoke(JSContext * 0x030dc6d0, unsigned int 1, unsigned int 2) line 732 + 13 bytes js_InternalInvoke(JSContext * 0x030dc6d0, JSObject * 0x027ccff8, long 42462056, unsigned int 0, unsigned int 1, long * 0x0012ee1c, long * 0x0012edac) line 805 + 19 bytes JS_CallFunctionValue(JSContext * 0x030dc6d0, JSObject * 0x027ccff8, long 42462056, unsigned int 1, long * 0x0012ee1c, long * 0x0012edac) line 2817 + 31 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x030dd790, void * 0x027ccff8, void * 0x0287eb68, unsigned int 1, void * 0x0012ee1c, int * 0x0012ee18, int 0) line 847 + 33 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x0312fb64) line 154 + 64 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x03776b00, nsIDOMEvent * 0x0312fb64, nsIDOMEventTarget * 0x030dc870, unsigned int 1, unsigned int 7) line 772 + 19 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x0364c590, nsEvent * 0x0012fa04, nsIDOMEvent * * 0x0012f310, nsIDOMEventTarget * 0x030dc870, unsigned int 7, nsEventStatus * 0x0012fa48) line 1341 + 39 bytes GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x030dc860, nsIPresContext * 0x0364c590, nsEvent * 0x0012fa04, nsIDOMEvent * * 0x0012f310, unsigned int 1, nsEventStatus * 0x0012fa48) line 419 nsWebShell::OnEndDocumentLoad(nsWebShell * const 0x030d245c, nsIDocumentLoader * 0x030

First you get an assertion failure and if you continue running from there you get a crash. Traceback for both the assertion failure and the crash are shown above. This has nothing to do with cookies. You get the same behaviour if cookies are enabled or disabled, if you have the warn checkbox checked or not. From the traceback it appears to be a problem in layout. Reassigning.

I created a local file of this and it still crashes. I removed all of the script and it no longer crashes (assert is still there, however). Attaching both testcases and passing off to script-land for further triage.

I'm assigning this to the Javascript engine component for further triage since elimination of the script eliminates the crash. Thanks for the help in triaging this...

Sorry - after some more poking around it is obvious that this is actually a dup of 45738. Removing the absolute and relative positioning makes the crash go away, with or without script. Since 45738 is already broken down into a nice testcase, I am marking this a dup of that bug. *** This bug has been marked as a duplicate of 45738 ***

Thanks - good catch! Verifying -