While working on another bug I had browser_styleeditor_reopen.js crash reliably: https://tbpl.mozilla.org/?tree=Try&rev=5805ebce61e4 That's the same crash as some of the comments in bug 707891. It's reproducible using a debug build on my Linux 64bit machine. Debugging with Valgrind brought up the following: http://pastebin.mozilla.org/1812606 The culprit I found was that we do: > nsCSSParser parser(loader, this); > // ... > mInner->mNameSpaceMap = nullptr; This causes parser->mNameSpaceMap to continue pointing to the old nameSpaceMap which is now in an invalid state because its members have been freed. If I'm not mistaken all we have to do is to make sure we null out mNameSpaceMap before creating the new parser so that the constructor can just set it to nullptr and create it when needed. This fixes the crash locally though I'm not at all familiar with the code to say if that has any unwanted side-effects...

Isn't this a duplicate of bug 781032?

Yes, sorry.

No need to be sorry! _I'm_ sorry you had to spend time on this. :(