###!!! ASSERTION: Only main list supported: 'aListID == kPrincipalList', file layout/generic/nsGfxScrollFrame.cpp, line 114 ###!!! ASSERTION: Must be a box frame!: '!mScrollCornerBox || mScrollCornerBox->IsBoxFrame()', file layout/generic/nsGfxScrollFrame.cpp, line 3515 ###!!! ASSERTION: A box layout method was called but InitBoxMetrics was never called: 'metrics', file layout/generic/nsFrame.cpp, line 8103 Crash [@ nsFrame::BoxReflow] The last 3 symptoms also appear in bug 812822, but the testcases seem unrelated.

This looks like a duplicate of bug 830299 to me, at first glance.

Crashes: 2013-01-22 Works: 2013-01-23 It's fixed by the first patch of bug 830299: https://hg.mozilla.org/mozilla-central/rev/3830ad0eb049

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0 Reproduced this issue with 2013-01-22 Nightly (Build ID: 20130122030956) using the testcase from comment 0. Verified fixed on Firefox 21 beta 2 (Build ID: 20130408165307), no crashes encountered with the same testcase. Althought, in Socorro there are some crashes with [@ nsFrame::BoxReflow(nsBoxLayoutState&, nsPresContext*, nsHTMLReflowMetrics&, nsRenderingContext*, int, int, int, int, bool)] signature for Firefox 21: https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=nsFrame%3A%3ABoxReflow%28nsBoxLayoutState%26amp%3B%2C%20nsPresContext%2A%2C%20nsHTMLReflowMetrics%26amp%3B%2C%20nsRenderingContext%2A%2C%20int%2C%20int%2C%20int%2C%20int%2C%20bool%29&reason_type=contains&date=04%2F09%2F2013%2014%3A06%3A07&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsFrame%3A%3ABoxReflow%28nsBoxLayoutState%26%2C%20nsPresContext%2A%2C%20nsHTMLReflowMetrics%26%2C%20nsRenderingContext%2A%2C%20int%2C%20int%2C%20int%2C%20int%2C%20bool%29#reports Could someone please verify if it's the same bug?