On Linux 64-bit, when I start up namoroka and get prompted to update my extensions, clicking the "Install Updates" button causes the following crash below. If I disable accessibility in Gnome, I don't see the crash. #0 nsIFrame::GetContent (this=0x7ffffffff0dea7ff) at /home/catlee/mozilla/mozilla-1.9.2/layout/base/../generic/nsIFrame.h:615 #1 0x00007ffff712148b in nsAccessibilityService::GetAccessible ( this=0x7fffde102c00, aNode=0x7fffe43decc8, aPresShell=0x7fffe4340800, aWeakShell=0x7fffe4361f80, aFrameHint=0x7fffffffb860, aIsHidden=0x7fffffffb86c, aAccessible=0x7fffffffb838) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessibilityService.cpp:1422 #2 0x00007ffff712dbb7 in nsAccessibleTreeWalker::GetAccessible ( this=0x7fffffffb830) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessibleTreeWalker.cpp:290 #3 0x00007ffff712dd68 in nsAccessibleTreeWalker::GetNextSibling ( this=0x7fffffffb830) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessibleTreeWalker.cpp:199 #4 0x00007ffff712c8ca in nsAccessible::CacheChildren (this=0x7fffe42d3ac0) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessible.cpp:765 #5 0x00007ffff714a659 in nsHyperTextAccessible::CacheChildren ( this=0x7fffe42d3ac0) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/html/nsHyperTextAccessible.cpp:217 #6 0x00007ffff7125846 in nsAccessible::GetChildCount ( this=0x7ffffffff0dea7ff, aAccChildCount=0x0) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessible.cpp:781 #7 0x00007ffff7125b93 in nsAccessible::GetFirstChild (this=0x7fffe42d3ac0, aFirstChild=0x7fffffffbaa0) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessible.cpp:655 #8 0x00007ffff714bb79 in getIndexInParentCB (aAtkObj=<value optimized out>) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/atk/nsAccessibleWrap.cpp:952 #9 0x00007ffff714bd13 in nsAccessibleWrap::FireAtkShowHideEvent ( this=<value optimized out>, aEvent=0x0, aObject=0x0, aIsAdded=-466797880) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/atk/nsAccessibleWrap.cpp:1472 #10 0x00007ffff714c105 in nsAccessibleWrap::FirePlatformEvent ( this=0x7fffe42d3ac0, aEvent=0x7fffdd593240) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/atk/nsAccessibleWrap.cpp:1317 #11 0x00007ffff7115a51 in nsDocAccessible::FlushPendingEvents ( this=0x7fffe42d3ac0) at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsDocAccessible.cpp:1793 #12 0x00007ffff71cd79a in nsTimerImpl::Fire (this=0x7fffdebed740) at /home/catlee/mozilla/mozilla-1.9.2/xpcom/threads/nsTimerImpl.cpp:427 #13 0x00007ffff71cd821 in nsTimerEvent::Run (this=0x7fffe12a5ba0) at /home/catlee/mozilla/mozilla-1.9.2/xpcom/threads/nsTimerImpl.cpp:519 #14 0x00007ffff71ca6e3 in nsThread::ProcessNextEvent (this=0x7fffed069080, mayWait=1, result=0x7fffffffbe6c) at /home/catlee/mozilla/mozilla-1.9.2/xpcom/threads/nsThread.cpp:527 #15 0x00007ffff7199c07 in NS_ProcessNextEvent_P (thread=0x7ffffffff0dea7ff, mayWait=1) at nsThreadUtils.cpp:230 ---Type <return> to continue, or q <return> to quit--- #16 0x00007ffff6f9ae59 in nsXULWindow::ShowModal (this=0x7fffed19b990) at /home/catlee/mozilla/mozilla-1.9.2/xpfe/appshell/src/nsXULWindow.cpp:414 #17 0x00007ffff6f7022e in nsWindowWatcher::OpenWindowJSInternal ( this=0x7fffed166100, aParent=0x0, aUrl=<value optimized out>, aName=<value optimized out>, aFeatures=0x7ffff6f37628 "H\201\307\20\377\377\377\353\1\220AWAVAUI\211\325ATUH\211\375S1\333H\201\354\350\1", aDialog=1, argv=0x7fffe41b5420, aCalledFromJS=0, _retval=0x7fffffffc998) at /home/catlee/mozilla/mozilla-1.9.2/embedding/components/windowwatcher/src/nsWindowWatcher.cpp:991 #18 0x00007ffff6f70c4a in nsWindowWatcher::OpenWindow (this=0x7fffed166100, aParent=0x0, aUrl=0x7fffe40f71c0 "chrome://mozapps/content/extensions/extensions.xul", aName=0x0, aFeatures=0x7fffe40f7200 "chrome,centerscreen,extra-chrome,dialog,resizable,modal", aArguments=0x1, _retval=0x7fffffffc998) at /home/catlee/mozilla/mozilla-1.9.2/embedding/components/windowwatcher/src/nsWindowWatcher.cpp:423 #19 0x00007ffff71d748a in NS_InvokeByIndex_P (that=0x7fffed166100, methodIndex=3, paramCount=6, params=0x7fffffffc920) at /home/catlee/mozilla/mozilla-1.9.2/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:208 #20 0x00007ffff68989f3 in XPCWrappedNative::CallMethod (ccx=..., mode=<value optimized out>) at /home/catlee/mozilla/mozilla-1.9.2/js/src/xpconnect/src/xpcwrappednative.cpp:2710 #21 0x00007ffff68a140f in XPC_WN_CallMethod (cx=0x7fffea187800, obj=0x7fffe40ffc80, argc=5, argv=0x7fffea10cdf0, vp=0x7fffffffcda8) at /home/catlee/mozilla/mozilla-1.9.2/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1740 #22 0x00007ffff614c7cb in js_Invoke (cx=0x7fffea187800, argc=5, vp=0x7fffea10cde0, flags=<value optimized out>) at /home/catlee/mozilla/mozilla-1.9.2/js/src/jsinterp.cpp:1374 #23 0x00007ffff613e018 in js_Interpret (cx=0x7fffea187800) at /home/catlee/mozilla/mozilla-1.9.2/js/src/jsops.cpp:2240 #24 0x00007ffff614cb88 in js_Invoke (cx=0x7fffea187800, argc=0, vp=0x7fffed04aac8, flags=<value optimized out>) at /home/catlee/mozilla/mozilla-1.9.2/js/src/jsinterp.cpp:1382 #25 0x00007ffff689538b in nsXPCWrappedJSClass::CallMethod ( this=0x7fffe4ebf6c0, wrapper=<value optimized out>, methodIndex=3, info=0x7fffe4450c10, nativeParams=0x7fffffffd7d0) at /home/catlee/mozilla/mozilla-1.9.2/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1671 #26 0x00007ffff71d804a in PrepareAndDispatch (self=0x7fffe4425440, methodIndex=<value optimized out>, args=0x7fffffffd930, gpregs=0x7fffffffd8b0, fpregs=0x7fffffffd8e0) at /home/catlee/mozilla/mozilla-1.9.2/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_64_linux.cpp:153 #27 0x00007ffff71d74ff in SharedStub () from ./objdir/dist/bin/libxul.so #28 0x00007ffff68696c3 in XRE_main (argc=<value optimized out>, argv=<value optimized out>, aAppData=<value optimized out>) at /home/catlee/mozilla/mozilla-1.9.2/toolkit/xre/nsAppRunner.cpp:3396 #29 0x0000000000401d81 in main (argc=1, argv=0x7fffffffe028) at /home/catlee/mozilla/mozilla-1.9.2/browser/app/nsBrowserApp.cpp:156

Something wrong in nsAccessibleTreeWalker::GetAccessible. It sounds mState.frame is bad object that was destroyed and it is passed to nsAccessibilityService::GetAccessible() . Therefore we fail to call frame->GetContent(), see http://mxr.mozilla.org/mozilla1.9.2/source/accessible/src/base/nsAccessibilityService.cpp#1422 This is another side of the bug 434445. We fire hide event (http://mxr.mozilla.org/mozilla1.9.2/source/accessible/src/atk/nsAccessibleWrap.cpp#1317) which is processed by AT, AT request indexOfParent which makes us to create and cache accessible children for destroyed element.

Alexander can you recreate it?

Just noticed the poison frame signature. You were first but the bug with momentum is topcrash bug 525579 (some reports have comments about add-on updates).