This is an offshoot from bug #76271. Steps from bug #76271 to reproduce assertions: 1. Launch Browser and open Composer. 2. Insert an image: Choose an image file and type something in Alternative Text area. 3. Click "More Properties" - Note there is no image sample file has been loading into the image area. 4. Align Text to Image | Change to wrap to left (anthing other than default). 5. In Editor, right click on the image to brings up the Image Properties, then change Align Text to Image to "wrap to right" - anything other than in step 4. You should now see 2 assertions thrown. The first one happens in nsAboutProtocolHandler::NewURI() because aBaseURI ("about:blank") is not NULL: ###!!! ASSERTION: base url passed into about protocol handler: '!aBaseURI', file y:\mozilla\netwerk\protocol\about\src\nsAboutProtocolHandler.cpp, line 101 ###!!! Break: at file y:\mozilla\netwerk\protocol\about\src\nsAboutProtocolHandl er.cpp, line 101 the second one happens in imgLoader::LoadImage(): ###!!! ASSERTION: imgLoader::LoadImage -- NULL URI pointer: 'aURI', file y:\mozi lla\modules\libpr0n\src\imgLoader.cpp, line 63 ###!!! Break: at file y:\mozilla\modules\libpr0n\src\imgLoader.cpp, line 63 Here's the stack trace to the method that is triggering both assertions: nsImageFrame::Init(nsImageFrame * const 0x00e9adb8, nsIPresContext * 0x09e7e580, nsIContent * 0x0b7be1b0, nsIFrame * 0x00d2ad84, nsIStyleContext * 0x09ef4120, nsIFrame * 0x00000000) line 304 + 111 bytes nsCSSFrameConstructor::InitAndRestoreFrame(nsIPresContext * 0x09e7e580, nsFrameConstructorState & {...}, nsIContent * 0x0b7be1b0, nsIFrame * 0x00d2ad84, nsIStyleContext * 0x09ef4120, nsIFrame * 0x00000000, nsIFrame * 0x00e9adb8) line 6663 + 32 bytes nsCSSFrameConstructor::ConstructFrameByTag(nsIPresShell * 0x09e78180, nsIPresContext * 0x09e7e580, nsFrameConstructorState & {...}, nsIContent * 0x0b7be1b0, nsIFrame * 0x00d2ad84, nsIAtom * 0x035f8280, int 3, nsIStyleContext * 0x09ef4120, nsFrameItems & {...}) line 4926 nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x09e78180, nsIPresContext * 0x09e7e580, nsFrameConstructorState & {...}, nsIContent * 0x0b7be1b0, nsIFrame * 0x00d2ad84, nsIAtom * 0x035f8280, int 3, nsIStyleContext * 0x09ef4120, nsFrameItems & {...}, int 0) line 7181 + 52 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x09e78180, nsIPresContext * 0x09e7e580, nsFrameConstructorState & {...}, nsIContent * 0x0b7be1b0, nsIFrame * 0x00d2ad84, nsFrameItems & {...}) line 7091 + 56 bytes nsCSSFrameConstructor::ContentInserted(nsCSSFrameConstructor * const 0x09e78510, nsIPresContext * 0x09e7e580, nsIContent * 0x09e479b0, nsIContent * 0x0b7be1b0, int 0, nsILayoutHistoryState * 0x09e91c90) line 8571 + 46 bytes nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext * 0x09e7e580, nsIContent * 0x0b7be1b0) line 11086 + 45 bytes nsCSSFrameConstructor::AttributeChanged(nsCSSFrameConstructor * const 0x09e78510, nsIPresContext * 0x09e7e580, nsIContent * 0x0b7be1b0, int 0, nsIAtom * 0x035f5cf0, int 6) line 9797 + 16 bytes StyleSetImpl::AttributeChanged(StyleSetImpl * const 0x09e78640, nsIPresContext * 0x09e7e580, nsIContent * 0x0b7be1b0, int 0, nsIAtom * 0x035f5cf0, int -1) line 1298 PresShell::AttributeChanged(PresShell * const 0x09e78188, nsIDocument * 0x09ec5700, nsIContent * 0x0b7be1b0, int 0, nsIAtom * 0x035f5cf0, int -1) line 4519 + 57 bytes nsDocument::AttributeChanged(nsDocument * const 0x09ec5700, nsIContent * 0x0b7be1b0, int 0, nsIAtom * 0x035f5cf0, int -1) line 1627 + 32 bytes nsHTMLDocument::AttributeChanged(nsHTMLDocument * const 0x09ec5700, nsIContent * 0x0b7be1b0, int 0, nsIAtom * 0x035f5cf0, int -1) line 1406 nsGenericHTMLElement::UnsetAttribute(nsGenericHTMLElement * const 0x0b7be1b0, int 0, nsIAtom * 0x035f5cf0, int 1) line 1646 nsGenericElement::RemoveAttribute(nsGenericElement * const 0x0b7be1b0, const nsAString & {...}) line 821 + 27 bytes nsHTMLImageElement::RemoveAttribute(nsHTMLImageElement * const 0x0b7be1b0, const nsAString & {...}) line 88 + 16 bytes ChangeAttributeTxn::DoTransaction(ChangeAttributeTxn * const 0x09ef3f80) line 71 + 36 bytes nsTransactionItem::DoTransaction() line 165 + 18 bytes nsTransactionManager::BeginTransaction(nsITransaction * 0x09ef3f80) line 1060 + 11 bytes nsTransactionManager::DoTransaction(nsTransactionManager * const 0x09eb3f20, nsITransaction * 0x09ef3f80) line 121 + 18 bytes nsEditor::Do(nsEditor * const 0x09ea84c0, nsITransaction * 0x09ef3f80) line 491 + 30 bytes nsEditor::RemoveAttribute(nsEditor * const 0x09ea84c0, nsIDOMElement * 0x0b7be1d8, const nsAString & {...}) line 1115 + 16 bytes nsEditor::CloneAttributes(nsEditor * const 0x09ea84c0, nsIDOMNode * 0x0b7be1d8, nsIDOMNode * 0x09edf8b8) line 2233 nsEditorShell::CloneAttributes(nsEditorShell * const 0x09e07f40, nsIDOMNode * 0x0b7be1d8, nsIDOMNode * 0x09edf8b8) line 2255 + 34 bytes XPTC_InvokeByIndex(nsISupports * 0x09e07f40, unsigned int 134, unsigned int 2, nsXPTCVariant * 0x0012800c) line 139 nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x0b7777c0, nsXPCWrappedNative * 0x09e82710, const XPCNativeMemberDescriptor * 0x00e6561c, nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 2, long * 0x00ef7160, long * 0x001281f4) line 934 + 42 bytes WrappedNative_CallMethod(JSContext * 0x0b7777c0, JSObject * 0x00e932b0, unsigned int 2, long * 0x00ef7160, long * 0x001281f4) line 250 + 34 bytes js_Invoke(JSContext * 0x0b7777c0, unsigned int 2, unsigned int 0) line 813 + 23 bytes js_Interpret(JSContext * 0x0b7777c0, long * 0x00128f74) line 2706 + 15 bytes js_Invoke(JSContext * 0x0b7777c0, unsigned int 1, unsigned int 2) line 830 + 13 bytes js_InternalInvoke(JSContext * 0x0b7777c0, JSObject * 0x00eacf28, long 15663712, unsigned int 0, unsigned int 1, long * 0x0012910c, long * 0x0012909c) line 902 + 20 bytes JS_CallFunctionValue(JSContext * 0x0b7777c0, JSObject * 0x00eacf28, long 15663712, unsigned int 1, long * 0x0012910c, long * 0x0012909c) line 3334 + 31 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x0b7775f0, void * 0x00eacf28, void * 0x00ef0260, unsigned int 1, void * 0x0012910c, int * 0x00129108, int 0) line 940 + 33 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x09d40e64) line 154 + 64 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x09ce1670, nsIDOMEvent * 0x09d40e64, nsIDOMEventTarget * 0x097f01f8, unsigned int 8, unsigned int 7) line 1033 + 19 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x09501ee0, nsEvent * 0x00129b30, nsIDOMEvent * * 0x001299f4, nsIDOMEventTarget * 0x097f01f8, unsigned int 7, nsEventStatus * 0x00129b78) line 1953 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x097f01f0, nsIPresContext * 0x09501ee0, nsEvent * 0x00129b30, nsIDOMEvent * * 0x001299f4, unsigned int 1, nsEventStatus * 0x00129b78) line 3673 PresShell::HandleDOMEventWithTarget(PresShell * const 0x09500ac0, nsIContent * 0x097f01f0, nsEvent * 0x00129b30, nsEventStatus * 0x00129b78) line 5262 + 39 bytes nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x09501ee0, nsGUIEvent * 0x00129d2c) line 181 nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x00ecf000, nsIPresContext * 0x09501ee0, nsGUIEvent * 0x00129d2c, nsEventStatus * 0x0012a040) line 128 PresShell::HandleEventInternal(nsEvent * 0x00129d2c, nsIView * 0x00000000, unsigned int 1, nsEventStatus * 0x0012a040) line 5230 + 41 bytes PresShell::HandleEventWithTarget(PresShell * const 0x09500ac0, nsEvent * 0x00129d2c, nsIFrame * 0x00ecf000, nsIContent * 0x097f01f0, unsigned int 1, nsEventStatus * 0x0012a040) line 5188 + 22 bytes nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 0x09d198a0, nsIPresContext * 0x09501ee0, nsMouseEvent * 0x0012a14c, nsEventStatus * 0x0012a040) line 2291 + 61 bytes nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x09d198a8, nsIPresContext * 0x09501ee0, nsEvent * 0x0012a14c, nsIFrame * 0x00ecf000, nsEventStatus * 0x0012a040, nsIView * 0x09501720) line 1390 + 28 bytes PresShell::HandleEventInternal(nsEvent * 0x0012a14c, nsIView * 0x09501720, unsigned int 1, nsEventStatus * 0x0012a040) line 5235 + 43 bytes PresShell::HandleEvent(PresShell * const 0x09500ac4, nsIView * 0x09501720, nsGUIEvent * 0x0012a14c, nsEventStatus * 0x0012a040, int 1, int & 1) line 5142 + 25 bytes nsView::HandleEvent(nsView * const 0x09501720, nsGUIEvent * 0x0012a14c, unsigned int 28, nsEventStatus * 0x0012a040, int 1, int & 1) line 377 nsViewManager::DispatchEvent(nsViewManager * const 0x095018c0, nsGUIEvent * 0x0012a14c, nsEventStatus * 0x0012a040) line 2039 HandleEvent(nsGUIEvent * 0x0012a14c) line 68 nsWindow::DispatchEvent(nsWindow * const 0x095015e4, nsGUIEvent * 0x0012a14c, nsEventStatus & nsEventStatus_eIgnore) line 701 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012a14c) line 722 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 4024 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 4269 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 28704945, long * 0x0012a51c) line 3006 + 24 bytes nsWindow::WindowProc(HWND__ * 0x03450a38, unsigned int 514, unsigned int 0, long 28704945) line 956 + 27 bytes USER32! 77e71820() GKLAYOUT! const nsSimplePageSequenceFrame::`vftable'{for `nsIFrame'} + 117 bytes

dup of fixed bug *** This bug has been marked as a duplicate of 76600 ***