See testcase, which crashes current trunk build after 500ms. This seems to have regressed when bug 374050 was fixed (although I'm not sure that counts as a regression). http://crash-stats.mozilla.com/report/index/2864bca3-6f6e-11dd-93b6-001a4bd43ed6?p=1 0 xul.dll nsSubDocumentFrame::Reflow layout/generic/nsFrameFrame.cpp:559 1 xul.dll nsAbsoluteContainingBlock::ReflowAbsoluteFrame layout/generic/nsAbsoluteContainingBlock.cpp:434 2 xul.dll xul.dll@0x2f4f35 3 xul.dll nsPageContentFrame::Reflow layout/generic/nsPageContentFrame.cpp:225 4 xul.dll nsContainerFrame::ReflowChild layout/generic/nsContainerFrame.cpp:782 5 xul.dll nsPageFrame::Reflow layout/generic/nsPageFrame.cpp:137 6 xul.dll nsContainerFrame::ReflowChild layout/generic/nsContainerFrame.cpp:782

The crash was fixed by bug 433616: http://hg.mozilla.org/mozilla-central/rev/5df4c3d437ee by null-checking 'mInnerView' before using it in nsSubDocumentFrame::Reflow(). So the crash is gone and only the assertion remains: ###!!! ASSERTION: What's going on?: 'mInnerView', nsFrameFrame.cpp, line 918 and this when closing the tab/window: ###!!! ASSERTION: null window: 'mWindow', nsDocumentViewer.cpp, line 1942

Bug 352093 (Part 12) removed: ASSERTION: What's going on?: 'mInnerView', nsFrameFrame.cpp Bug 522352 removed: ASSERTION: null window: 'mWindow', nsDocumentViewer.cpp