Reloading the attached testcase frequently leads to the following crash (snipped for brevity, full stack in an attachment): Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: 13 at address: 0x0000000000000000 0x000000010476ced8 in JS_DHashTableOperate (table=0x14c900000, key=0x14605f080, op=JS_DHASH_LOOKUP) at /Users/anant/Code/mozilla-inbound/js/src/jsdhash.cpp:571 571 keyHash = table->ops->hashKey(table, key); (gdb) bt #0 0x000000010476ced8 in JS_DHashTableOperate (table=0x14c900000, key=0x14605f080, op=JS_DHASH_LOOKUP) at /Users/anant/Code/mozilla-inbound/js/src/jsdhash.cpp:571 #1 0x0000000102c45a53 in Native2WrappedNativeMap::Find (this=0x1464fc810, Obj=0x14605f080) at XPCMaps.h:100 ... #65 0x0000000100001d3e in do_main (argc=3, argv=0x7fff5fbffa98) at /Users/anant/Code/mozilla-inbound/browser/app/nsBrowserApp.cpp:174 #66 0x00000001000015b7 in main (argc=3, argv=0x7fff5fbffa98) at /Users/anant/Code/mozilla-inbound/browser/app/nsBrowserApp.cpp:279 This appears to be a bug in the way we use XPConnect (or XPConnect itself, which is less likely) where an object is being held even after the page is gone.

Probably fixed by another bug. Set up auto-reload after finishing, runs with no crashes. then also constantly clicked on the reload button on and off, no problems.