Closed Bug 40696 Opened 24 years ago Closed 24 years ago

When loading main page of mozillazine, browser segfaults

Categories

(Core :: Layout, defect, P1)

Product:
Core
Component:
Layout
Platform:
x86
Linux
Type:
defect

Tracking

()

Status:
VERIFIED WORKSFORME
Milestone:
Future

People

(Reporter: dwelch, Assigned: waqar)

References

(
URL
)

Details

(Keywords: crash) 

I've been having this problem for about the last week or two of the daily
builds. Last I tried this with was 2000052508. I type the URL in the location
bar, it looks like it tries to load the page, and moz simply "dies" with a
segmentation fault.

I haven't seen this with other sites yet.
Unable to reproduce this with M16 Linux 2000-052520
Are you sure you have done a clean install? There have been several builds the
last week where one had to delete ~/.mozilla first:
both .js files and cache handling has changed.
Please try this if you haven't, and report back.

I removed my .mozilla directory and re-ran the test and have the same results,
but you are using a slightly later build than I. I tried this morning's build
and got the same results with a fresh .mozilla directory.
->networking for resolve or triage
Assignee: asadotzler → gagan
Severity: major → critical
Component: Browser-General → Networking
Keywords: crash
QA Contact: jelwell → tever
WFM with 2000-05-26-20 on Linux (kernel 2.2.13, glibc 2.1.1-6).
I rm ~/.mozilla, launch mozilla, type www.mozillazine.org in the URL bar
and it does not crash.

My setup is:

Kernel 2.2.14
glibc-2.1.2

I tried last night's last Linux build (rm ~/.mozilla of course) and still
crashes on mozillazine. 
before you try again, will you please cd -mozilla and do an ls -ltr to see if
all directories etc. are indeed deleted?
If there are still something in that dir, do this:
Open a terminal window (xterm or xrvt or gnome-terminal or whatever you use)
Write:
pwd     to verify you are in .mozilla dir !!!! If not, cd into it - then:
rm -rf *

This will perform a recursive delete of ALL directories and files in and below
the .mozilla directory. The now empty directory only called .mozilla you can
keep: it will only be recreated when you start mozilla again.

Before you start mozilla: also check that you don't have any old processes from
previous crash'es:

ps -aux |grep moz
Kill mozilla processes if you find any hanging.

Then start mozilla afresh and try again.
Here's my session to prove that I'm doing this right. (2000052920 build) 

[dwelch@cartman dwelch]$ cd .mozilla
[dwelch@cartman .mozilla]$ ls -la
total 20
drwx------    3 dwelch   users        4096 Jun  1 09:23 ./
drwx------   48 dwelch   users        8192 Jun  1 09:17 ../
drwxr-xr-x    6 dwelch   users        4096 Jun  1 09:23 default/
-rw-r--r--    1 dwelch   users         872 Jun  1 09:23 registry
[dwelch@cartman .mozilla]$ rm -rf *
[dwelch@cartman .mozilla]$ ls -la
total 12
drwx------    2 dwelch   users        4096 Jun  1 09:25 ./
drwx------   48 dwelch   users        8192 Jun  1 09:17 ../
[dwelch@cartman .mozilla]$ pwd
/home/dwelch/.mozilla
[dwelch@cartman .mozilla]$ cd ../package
[dwelch@cartman package]$ ./mozilla
.//run-mozilla.sh ./mozilla-bin
MOZILLA_FIVE_HOME=/home/dwelch/package
  LD_LIBRARY_PATH=/home/dwelch/package
     LIBRARY_PATH=/home/dwelch/package
       SHLIB_PATH=/home/dwelch/package
          LIBPATH=/home/dwelch/package
       ADDON_PATH=/home/dwelch/package
      MOZ_PROGRAM=./mozilla-bin
      MOZ_TOOLKIT=
        moz_debug=0
     moz_debugger=
RegSelf Unicode to Big5 converter complete
RegSelf Unicode to x-x-big5 converter complete
RegSelf Big5 to Unicode converter complete
nNCL: registering deferred (0)

Gdk-WARNING **: locale not supported by C library
Profile Manager : Profile Wizard and Manager activites : Begin
Profile Manager : Command Line Options : Begin
Profile Manager : Command Line Options : End
ProfileManager : CreateNewProfile
Profile Name: default
Profile Dir: /home/dwelch/.mozilla
before SetProfileDir
ProfileManager : CreateUserDirectories
after SetProfileDir
ProfileManager : GetProfileDir
ProfileManager : GetProfileDir
Profile Manager : Profile Wizard and Manager activites : End
WEBSHELL+ = 1
WEBSHELL+ = 2
CSSLoaderImpl::LoadAgentSheet: Load of URL
'file:///home/dwelch/.mozilla/default/chrome/user.css' failed.  Error code:
16389
assuming d&d is off for Personal Toolbar
WEBSHELL+ = 3
Setting content window
*** Pulling out the charset
Loading page specified via openDialog
in SetSecurityButton
WEBSHELL+ = 4
WEBSHELL+ = 4
Warning - table cell content max element height 270 greater than desired height
248
Warning - table cell content max element height 255 greater than desired height
240 
[...]
Document: Done (2.883 secs)
*** check number of frames in content area
Document http://www.mozilla.org/mozorg.html loaded successfully
Pressed mDragStartPx=165
WEBSHELL+ = 5
->>>>>>>>>>>>>> Write Clipboard to memory
Entry at index 0 is http://www.mozillazine.org/
WEBSHELL+ = 6
*** check number of frames in content area
WEBSHELL+ = 7
.//run-mozilla.sh: line 29:   982 Segmentation fault      $prog ${1+"$@"}   
For the record, with the same build (now with a 2.2.15 kernel) I don't get these
messages:

RegSelf Unicode to Big5 converter complete
RegSelf Unicode to x-x-big5 converter complete
RegSelf Big5 to Unicode converter complete
nNCL: registering deferred (0)

Gdk-WARNING **: locale not supported by C library


Also I don't get the "Pressed mDragStartPx=165" near the end.
Eventually I don't get the crash, but rather:

*** check number of frames in content area 
Document: Done (5.771 secs)
*** check number of frames in content area 
Document http://www.mozillazine.org/ loaded successfully
*** check number of frames in content area 
Document: Done (5.98 secs)


If someone can give me instructions for generating a debug build, I will build
it and send in a core file (I'm currently not getting a core when I get the
segfault message).

Dameon, building a debug build can be very useful, but it needs quite a lot of
disk space (you should have about 1 GB free). I can send you a short description
if you like. But maybe it's easier to try first if the nightly binaries give 
you a stack trace that is useful. You will need gdb 4.95.0 or later.
See http://www.ags.uni-sb.de/~afranke/mozilla/quick-gdb.html 
I haven't had a problem with this bug at all with 2000060409 in Linux 2.2.14. 
I'm going to have a few others check this bug and then if it is good,
WORKSFORME.
WFM 2000060508 Redhat 6.1

I was able to generate a stack trace of this problem from 2000042708 source
code. (I'll try today's tarball also). Unfortunately, I can't get an actual core
file unless someone tells me how to get gdb to generate one.

Program received signal SIGSEGV, Segmentation fault.
0x0150f3ec in nsBlockFrame::DoRemoveFrame (this=0x8689f60,
    aPresContext=0x8745fa8, aDeletedFrame=0x89f0b1c) at nsBlockFrame.cpp:5525
5525          line = flow->mLines;
(gdb) where
#0  0x0150f3ec in nsBlockFrame::DoRemoveFrame (this=0x8689f60,
    aPresContext=0x8745fa8, aDeletedFrame=0x89f0b1c) at nsBlockFrame.cpp:5525
#1  0x0150f568 in nsBlockFrame::DeleteChildsNextInFlow (this=0x8689f60,
    aPresContext=0x8745fa8, aChild=0x8689fe8) at nsBlockFrame.cpp:5550
#2  0x0151434e in nsBlockReflowContext::ReflowBlock (this=0xbfffe1e4,
    aFrame=0x8689fe8, aSpace=@0xbfffe128, aApplyTopMargin=1,
    aPrevBottomMargin=0, aIsAdjacentWithTop=1, aComputedOffsets=@0xbfffe138,
    aFrameReflowStatus=@0xbfffe11c) at nsBlockReflowContext.cpp:560
#3  0x0150c180 in nsBlockFrame::ReflowBlockFrame (this=0x8689f60,
    aState=@0xbfffe5ec, aLine=0x868a05c, aKeepReflowGoing=0xbfffe390)
    at nsBlockFrame.cpp:3838
#4  0x0150aa0e in nsBlockFrame::ReflowLine (this=0x8689f60,
    aState=@0xbfffe5ec, aLine=0x868a05c, aKeepReflowGoing=0xbfffe390,
    aDamageDirtyArea=1) at nsBlockFrame.cpp:3102
#5  0x0150a31b in nsBlockFrame::ReflowDirtyLines (this=0x8689f60,
    aState=@0xbfffe5ec) at nsBlockFrame.cpp:2909
#6  0x01507d40 in nsBlockFrame::Reflow (this=0x8689f60,
    aPresContext=0x8745fa8, aMetrics=@0xbfffe9a4, aReflowState=@0xbfffe900,
    aStatus=@0xbfffecb0) at nsBlockFrame.cpp:1727
#7  0x015189fc in nsContainerFrame::ReflowChild (this=0x86892ec,
    aKidFrame=0x8689f60, aPresContext=0x8745fa8, aDesiredSize=@0xbfffe9a4,
    aReflowState=@0xbfffe900, aX=0, aY=0, aFlags=0, aStatus=@0xbfffecb0)
    at nsContainerFrame.cpp:693
---Type <return> to continue, or q <return> to quit---
#8  0x015324e7 in CanvasFrame::Reflow (this=0x86892ec, aPresContext=0x8745fa8,
    aDesiredSize=@0xbfffec7c, aReflowState=@0xbfffeabc, aStatus=@0xbfffecb0)
    at nsHTMLFrame.cpp:301  

WFM 20000060208 Mandrake 7 beta PC

confirming, stack trace points to layout.
Assignee: gagan → clayton
Status: UNCONFIRMED → NEW
Component: Networking → Layout
Ever confirmed: true
QA Contact: tever → petersen
Re-assigning to buster as part of clayton's bug triage.  I'm sorry that I'm not 
close to a Linux machine and can't verify if this is happening in the latest 
builds.  If anybody can do this, it'll save buster some time.  Thanks.
Assignee: clayton → buster
waqar: handing off to you.  sounds like a linux-only crash that depends on the 
specific configuration of the machine maybe.  I haven't been able to reproduce 
on windows, and based on others' comments in this bug, others are unable to 
reproduce as well.  Maybe it's already fixed?
Assignee: buster → waqar
Priority: P3 → P1
This bug has been marked "future" because the original netscape engineer working
on this is over-burdened. If you feel this is an error, that you or another
known resource will be working on this bug,or if it blocks your work in some way
-- please attach your concern to the bug for reconsideration.
Using the the source tarball from 20000611, I see the following behaviour:

1. Using VNC 3.3.3 as the X server, no crash when I load the page. The only
   anomaly here is that the fonts look different. Hmph...

2. When using XFree86-3.3.6-4mdk, I get a stacktrace (and debug output) that
   looks like this (note I only loaded the raptor symbols as that is where
   the problem is believed to be):

Entry at index 0 is http://www.mozillazine.org
Enabling Quirk StyleSheet
Enabling Quirk StyleSheet
WEBSHELL+ = 6
WARNING: cell content 0x87a4e50 has large max element height 1073742146 
WARNING: cell content 0x87a4e50 has large height 1073742146 
nsBlockReflowContext: TableOuter(table)(9)@0x8798800 metrics=9465,1073742206!
###!!! ASSERTION: bad status: 'NS_FRAME_IS_COMPLETE(aStatus)', file 
nsBoxToBlockAdaptor.cpp, line 777
###!!! Break: at file nsBoxToBlockAdaptor.cpp, line 777
nsBlockReflowContext: TableOuter(table)(9)@0x8798800 metrics=9465,1073742206!
###!!! ASSERTION: bad status: 'NS_FRAME_IS_COMPLETE(aStatus)', file 
nsBoxToBlockAdaptor.cpp, line 777
###!!! Break: at file nsBoxToBlockAdaptor.cpp, line 777
WEBSHELL+ = 7
###!!! ASSERTION: can't find deleted frame in lines: 'nsnull != line', file 
nsBlockFrame.cpp, line 5458
###!!! Break: at file nsBlockFrame.cpp, line 5458
###!!! ASSERTION: bad prevSibling: 'tmp == aDeletedFrame', file 
nsBlockFrame.cpp, line 5462
###!!! Break: at file nsBlockFrame.cpp, line 5462
###!!! ASSERTION: whoops, continuation without a parent: 'nsnull != flow', file 
nsBlockFrame.cpp, line 5576
###!!! Break: at file nsBlockFrame.cpp, line 5576

Program received signal SIGSEGV, Segmentation fault.
0x014e06bc in ?? ()
(gdb) shar raptor 
Symbols already loaded for /home/dwelch/mozilla/dist/bin/./libraptorgfx.so
Symbols already loaded for /home/dwelch/mozilla/dist/bin/./libraptorwebwidget.so
Reading symbols from /home/dwelch/mozilla/dist/bin/./libraptorplugin.so...done.
Loaded symbols for /home/dwelch/mozilla/dist/bin/./libraptorplugin.so
Reading symbols from 
/home/dwelch/mozilla/dist/bin/./components/libraptorhtml.so...done.
Loaded symbols for /home/dwelch/mozilla/dist/bin/./components/libraptorhtml.so
Reading symbols from 
/home/dwelch/mozilla/dist/bin/./components/libraptorhtmlpars.so...done.
Loaded symbols for 
/home/dwelch/mozilla/dist/bin/./components/libraptorhtmlpars.so
Reading symbols from 
/home/dwelch/mozilla/dist/bin/./components/libraptorview.so...done.
Loaded symbols for /home/dwelch/mozilla/dist/bin/./components/libraptorview.so
(gdb) where
#0  0x014e06bc in nsBlockFrame::DoRemoveFrame (this=0x87e7f90, 
    aPresContext=0x865d4c0, aDeletedFrame=0x8989c84) at nsBlockFrame.cpp:5578
#1  0x014e0838 in nsBlockFrame::DeleteChildsNextInFlow (this=0x87e7f90, 
    aPresContext=0x865d4c0, aChild=0x87e8018) at nsBlockFrame.cpp:5603
#2  0x014e561e in nsBlockReflowContext::ReflowBlock (this=0xbfffe520, 
    aFrame=0x87e8018, aSpace=@0xbfffe464, aApplyTopMargin=1, 
    aPrevBottomMargin=0, aIsAdjacentWithTop=1, aComputedOffsets=@0xbfffe474, 
    aFrameReflowStatus=@0xbfffe458) at nsBlockReflowContext.cpp:560
#3  0x014dd450 in nsBlockFrame::ReflowBlockFrame (this=0x87e7f90, 
    aState=@0xbfffe928, aLine=0x87e808c, aKeepReflowGoing=0xbfffe6cc)
    at nsBlockFrame.cpp:3876
#4  0x014dbcde in nsBlockFrame::ReflowLine (this=0x87e7f90, 
    aState=@0xbfffe928, aLine=0x87e808c, aKeepReflowGoing=0xbfffe6cc, 
    aDamageDirtyArea=1) at nsBlockFrame.cpp:3140
#5  0x014db5eb in nsBlockFrame::ReflowDirtyLines (this=0x87e7f90, 
    aState=@0xbfffe928) at nsBlockFrame.cpp:2947
#6  0x014d90f0 in nsBlockFrame::Reflow (this=0x87e7f90, 
    aPresContext=0x865d4c0, aMetrics=@0xbfffece0, aReflowState=@0xbfffec3c, 
    aStatus=@0xbfffefec) at nsBlockFrame.cpp:1746
#7  0x014e9d2c in nsContainerFrame::ReflowChild (this=0x87e7304, 
    aKidFrame=0x87e7f90, aPresContext=0x865d4c0, aDesiredSize=@0xbfffece0, 
    aReflowState=@0xbfffec3c, aX=0, aY=0, aFlags=0, aStatus=@0xbfffefec)
    at nsContainerFrame.cpp:693
---Type <return> to continue, or q <return> to quit---
#8  0x01503877 in CanvasFrame::Reflow (this=0x87e7304, aPresContext=0x865d4c0, 
    aDesiredSize=@0xbfffefb8, aReflowState=@0xbfffedf8, aStatus=@0xbfffefec)
    at nsHTMLFrame.cpp:301
#9  0x01770782 in nsBoxToBlockAdaptor::Reflow (this=0x87e7f34, 
    aState=@0xbffff284, aPresContext=0x865d4c0, aDesiredSize=@0xbfffefb8, 
    aReflowState=@0xbffff3a0, aStatus=@0xbfffefec, aX=0, aY=0, aWidth=9465, 
    aHeight=5115, aMoveFrame=1) at nsBoxToBlockAdaptor.cpp:775
#10 0x0176ff10 in nsBoxToBlockAdaptor::Layout (this=0x87e7f34, 
    aState=@0xbffff284) at nsBoxToBlockAdaptor.cpp:431
#11 0x0154754f in nsScrollPortFrame::Layout (this=0x87e73e0, 
    aState=@0xbffff284) at nsScrollPortFrame.cpp:332
#12 0x01772a84 in nsContainerBox::LayoutChildAt (aState=@0xbffff284, 
    aBox=0x87e7418, aRect=@0xbffff1b4) at nsContainerBox.cpp:609
#13 0x01545778 in nsGfxScrollFrameInner::LayoutBox (this=0x86ea1b8, 
    aState=@0xbffff284, aBox=0x87e7418, aRect=@0xbffff1b4)
    at nsGfxScrollFrame.cpp:1016
#14 0x01545a2f in nsGfxScrollFrameInner::Layout (this=0x86ea1b8, 
    aState=@0xbffff284) at nsGfxScrollFrame.cpp:1101
#15 0x0154580a in nsGfxScrollFrame::Layout (this=0x87e733c, aState=@0xbffff284)
    at nsGfxScrollFrame.cpp:1029
#16 0x01781575 in nsBoxFrame::Reflow (this=0x87e7340, aPresContext=0x865d4c0, 
    aDesiredSize=@0xbffff44c, aReflowState=@0xbffff3a0, aStatus=@0xbffff59c)
    at nsBoxFrame.cpp:648
---Type <return> to continue, or q <return> to quit---
#17 0x0154499e in nsGfxScrollFrame::Reflow (this=0x87e733c, 
    aPresContext=0x865d4c0, aDesiredSize=@0xbffff44c, 
    aReflowState=@0xbffff3a0, aStatus=@0xbffff59c) at nsGfxScrollFrame.cpp:715
#18 0x014e9d2c in nsContainerFrame::ReflowChild (this=0x87e72c8, 
    aKidFrame=0x87e7340, aPresContext=0x865d4c0, aDesiredSize=@0xbffff44c, 
    aReflowState=@0xbffff3a0, aX=0, aY=0, aFlags=0, aStatus=@0xbffff59c)
    at nsContainerFrame.cpp:693
#19 0x01542917 in ViewportFrame::Reflow (this=0x87e72c8, 
    aPresContext=0x865d4c0, aDesiredSize=@0xbffff610, 
    aReflowState=@0xbffff4f8, aStatus=@0xbffff59c) at nsViewportFrame.cpp:545
#20 0x015052ac in nsHTMLReflowCommand::Dispatch (this=0x86b2dd0, 
    aPresContext=0x865d4c0, aDesiredSize=@0xbffff610, aMaxSize=@0xbffff5f0, 
    aRendContext=@0x899fa60) at nsHTMLReflowCommand.cpp:144
#21 0x0152b9ff in PresShell::ProcessReflowCommands (this=0x873cc80, 
    aInterruptible=1) at nsPresShell.cpp:3796
#22 0x018610fa in ReflowEvent::HandleEvent (this=0x898d568)
    at nsPresShell.cpp:3684
#23 0x0152b52c in HandlePLEvent (aEvent=0x898d568) at nsPresShell.cpp:3695
#24 0x00228f3b in PL_HandleEvent (self=0x898d568) at plevent.c:575
#25 0x00228dcc in PL_ProcessPendingEvents (self=0x813a8d8) at plevent.c:520
#26 0x0022ad29 in nsEventQueueImpl::ProcessPendingEvents (this=0x813a8b0)
    at nsEventQueue.cpp:356
#27 0x00b3b353 in ?? ()
---Type <return> to continue, or q <return> to quit---
   from /home/dwelch/mozilla/dist/bin/./components/libwidget_gtk.so
#28 0x00b3af32 in ?? ()
   from /home/dwelch/mozilla/dist/bin/./components/libwidget_gtk.so
#29 0x00cc2fdc in ?? () from /usr/lib/libglib-1.2.so.0
#30 0x00cc4736 in ?? () from /usr/lib/libglib-1.2.so.0
#31 0x00cc4d43 in ?? () from /usr/lib/libglib-1.2.so.0
#32 0x00cc4eec in ?? () from /usr/lib/libglib-1.2.so.0
#33 0x00c1a5d9 in ?? () from /usr/lib/libgtk-1.2.so.0
#34 0x00b3ba65 in ?? ()
   from /home/dwelch/mozilla/dist/bin/./components/libwidget_gtk.so
#35 0x007f76af in ?? ()
   from /home/dwelch/mozilla/dist/bin/./components/libnsappshell.so
#36 0x08053239 in main1 (argc=1, argv=0xbffffb54, nativeApp=0x0)
    at nsAppRunner.cpp:906
#37 0x08053938 in main (argc=1, argv=0xbffffb54) at nsAppRunner.cpp:1092
#38 0x0064ecae in __libc_start_main () from /lib/libc.so.6

wanted to be sure this was nominated for early examination.
waqar added some verbage about moving this to "future", but I think that was a 
mistake.  he didn't actually set the milestone, at least.
Keywords: nsbeta2
Putting on [nsbeta2+] radar for beta2 fix.
Whiteboard: [nsbeta2+]
As of build 2000061208, moz crashes when attempting to load www.tek-tips.com,
although build 2000060908 works.  For me, www.mozillazine.org loads OK with
builds 2000060908, 2000061220 and 2000061320.  I'm running SuSE Linux 6.2 (X
version 3.3.4), but with kernel 2.2.16.  Kernel was compiled with gcc 2.7.2.  I
just rechecked these builds - same results.

With todays build I am not able to crash on mozillazine.org but I am can crash on 

tek-tips.com.


The tek-tips.com is a different bug, it carshes in javascipt engine. I am going
to close this one since I can reprodue it. killebrew@pan-tex.net can you create
a bug for javascript and assign it to the javascript team.
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → WORKSFORME
OK, waqar@netscape.com, I'll check the tek-tips page with NS4.7 and issue a
javascript bug if I can verify it.

I found another instance of a page crashing Moz.  It's huge, but just simple
HTML (I think).  I'll check it for unclosed tags and report back if it isn't a
duplicate of bug 18480 on the "Most Frequent" list.  The page is http:
//www.suse.de/en/produkte/susesoft/linux/Pakete/gesamt.html
Checked the tek-tips page using NS4.7.  I don' see no steenkin' javascript, just
a potload of intricate HTML (but bear in mind I'm not a webpage programmer). 
This seems to be the theme of pages that make Mozilla dump now - big and
complicated.  Until June 12 builds (+/-), Moz was able to handle the
www.tek-tips.com page.  Another thought:  I'm fairly certain this site runs on
NT.  But the page looks to have been hand coded, or at least hand-tuned - no
authoring tool tracks.
Ah, yes, there's javascript.  I'll issue a new bug.

Marking verified worksforme.
Status: RESOLVED → VERIFIED
Still having issue with today's daily build. System has been upgraded to
Mandrake 7.1.
Status: VERIFIED → REOPENED
Resolution: WORKSFORME → ---
It will be hardly possible to keep this plussed. Anyway, Dameon, since you are
able to build debug, can you issue "where full" at the gdb prompt and attach the
output to this bug (at least for the first few stack frames)? Then chances are
that we will find a fix even if we can't reproduce it.
cc self.
Here is a "where full" on 19 Jul 2000 source (the first 20 frames). If you need 
full output, let me know.

#0  0x015e9817 in nsBlockFrame::DoRemoveFrame (this=0x88dde38, 
    aPresContext=0x8704940, aDeletedFrame=0x89fb4e0) at nsBlockFrame.cpp:5588
        this = (nsBlockFrame *) 0x88dde38
        presShell = {mRawPtr = 0x877e1e8}
        flow = (nsBlockFrame *) 0x0
        linep = (nsLineBox **) 0x88dded4
        line = (nsLineBox *) 0x0
        prevLine = (nsLineBox *) 0x0
        prevSibling = (nsIFrame *) 0x88dde84
#1  0x015e999d in nsBlockFrame::DeleteChildsNextInFlow (this=0x88dde38, 
    aPresContext=0x8704940, aChild=0x88dde84) at nsBlockFrame.cpp:5613
        this = (nsBlockFrame *) 0x88dde38
        nextInFlow = (nsIFrame *) 0x89fb4e0
        parent = (nsBlockFrame *) 0x88dde38
#2  0x015ee42d in nsBlockReflowContext::DoReflowBlock (this=0xbfffe15c, 
    aReflowState=@0xbfffdf2c, aReason=eReflowReason_Incremental, 
    aFrame=0x88dde84, aSpace=@0xbfffe0a4, aApplyTopMargin=1, 
    aPrevBottomMargin=0, aIsAdjacentWithTop=1, aComputedOffsets=@0xbfffe0b4, 
    aFrameReflowStatus=@0xbfffe098) at nsBlockReflowContext.cpp:609
        parent = (nsHTMLContainerFrame *) 0x88dde38
        kidNextInFlow = (nsIFrame *) 0x89fb4e0
        this = (nsBlockReflowContext *) 0xbfffe15c
        rv = 0
        state = 5
        topMargin = 0
        x = 0
        y = 0
        view = (nsIView *) 0x0
        tx = 0
        ty = 0
#3  0x015edd87 in nsBlockReflowContext::ReflowBlock (this=0xbfffe15c, 
    aFrame=0x88dde84, aSpace=@0xbfffe0a4, aApplyTopMargin=1, 
    aPrevBottomMargin=0, aIsAdjacentWithTop=1, aComputedOffsets=@0xbfffe0b4, 
    aFrameReflowStatus=@0xbfffe098) at nsBlockReflowContext.cpp:344
        normalReflowState = {parentReflowState = 0xbfffe8d8, 
  frame = 0x88dde84, reason = eReflowReason_Incremental, 
  reflowCommand = 0x88ff548, availableWidth = 10095, 
  availableHeight = 1073741824, rendContext = 0x89fd928, 
  isTopOfPage = 0 '\000', mFrameType = 2, mSpaceManager = 0x8963c28, 
  mLineLayout = 0x0, mComputedWidth = 10095, mComputedHeight = 1073741824, 
  mComputedMargin = {left = 0, top = 0, right = 0, bottom = 0}, 
  mComputedBorderPadding = {left = 0, top = 0, right = 0, bottom = 0}, 
  mComputedPadding = {left = 0, top = 0, right = 0, bottom = 0}, 
  mComputedOffsets = {left = 0, top = 0, right = 0, bottom = 0}, 
  mComputedMinWidth = 0, mComputedMaxWidth = 1073741824, 
  mComputedMinHeight = 0, mComputedMaxHeight = 1073741824, 
  mCompactMarginWidth = 0, mAlignCharOffset = 0, 
  mUseAlignCharOffset = 0 '\000', mStyleDisplay = 0x88ea030, 
  mStylePosition = 0x88e9fac, mStyleSpacing = 0x88e9eb8, mReflowDepth = 4}
        this = (nsBlockReflowContext *) 0xbfffe15c
        rv = 0
        reason = eReflowReason_Incremental
        state = 4
        availSpace = {width = 10095, height = 1073741824}
        position = (nsStylePosition *) 0x88e9fac
        widthUnit = eStyleUnit_Auto
        display = (nsStyleDisplay *) 0x88ea030
#4  0x015e6254 in nsBlockFrame::ReflowBlockFrame (this=0x88dde38, 
    aState=@0xbfffe5a0, aLine=0x88dded0, aKeepReflowGoing=0xbfffe334)
    at nsBlockFrame.cpp:3880
        this = (nsBlockFrame *) 0x88dde38
        rv = 0
        frame = (nsIFrame *) 0x88dde84
        display = (nsStyleDisplay *) 0x88ea030
        brc = {mPresContext = 0x8704940, mOuterReflowState = @0xbfffe8d8, 
  mFrame = 0x88dde84, mSpace = {x = 0, y = 0, width = 10095, 
    height = 1073741824}, mNextRCFrame = 0x0, mStyleSpacing = 0x88e9eb8, 
  mComputedWidth = 10095, mMargin = {left = 0, top = 0, right = 0, 
    bottom = 0}, mX = 0, mY = 0, mMetrics = {width = 10095, height = 2730, 
    ascent = 2730, descent = 0, maxElementSize = 0x0, mMaximumWidth = 0, 
    mCarriedOutBottomMargin = 0, mOverflowArea = {x = 0, y = 0, width = 10095, 
      height = 2730}, mFlags = 0, mNothingChanged = 0}, mTopMargin = 0, 
  mMaxElementSize = {width = 0, height = 0}, mIsTable = 0 '\000', 
  mComputeMaximumWidth = 0 '\000', mBlockShouldInvalidateItself = 0 '\000'}
        applyTopMargin = 1
        framePrevInFlow = (nsIFrame *) 0x0
        breakType = 0 '\000'
        topMargin = 0
        isImpacted = 0
        splitType = 3
        availSpace = {x = 0, y = 0, width = 10095, height = 1073741824}
        frameReflowStatus = 0
        computedOffsets = {left = 0, top = 0, right = 0, bottom = 0}
#5  0x015e491d in nsBlockFrame::ReflowLine (this=0x88dde38, 
    aState=@0xbfffe5a0, aLine=0x88dded0, aKeepReflowGoing=0xbfffe334, 
    aDamageDirtyArea=1) at nsBlockFrame.cpp:3144
        rv = 0
        oldCombinedArea = {x = 0, y = 0, width = 10095, height = 1605}
#6  0x015e41df in nsBlockFrame::ReflowDirtyLines (this=0x88dde38, 
    aState=@0xbfffe5a0) at nsBlockFrame.cpp:2951
        oldHeight = 1605
        oldCombinedArea = {x = 0, y = 0, width = 10095, height = 1605}
        forceInvalidate = 1
        newHeight = 0
        next = (nsLineBox *) 0x88dded0
        this = (nsBlockFrame *) 0x88dde38
        rv = 0
        keepGoing = 1
        incrementalReflow = 1
        deltaY = 0
        line = (nsLineBox *) 0x88dded0
#7  0x015e19a3 in nsBlockFrame::Reflow (this=0x88dde38, 
    aPresContext=0x8704940, aMetrics=@0xbfffe978, aReflowState=@0xbfffe8d8, 
    aStatus=@0xbfffeca0) at nsBlockFrame.cpp:1756
        start = 616378951475124756
        ctc = 23048885
        spaceManager = {mRawPtr = 0x8963c28}
        oldSpaceManager = (nsISpaceManager *) 0x88ea400
        state = {mBlock = 0x88dde38, mPresContext = 0x8704940, 
  mReflowState = @0xbfffe8d8, mSpaceManager = 0x8963c28, mSpaceManagerX = 0, 
  mSpaceManagerY = 0, mReflowStatus = 0, mBottomEdge = 1073741824, 
  mContentArea = {width = 10095, height = 1073741824}, 
  mCurrentLine = 0x88dded0, mPrevLine = 0x0, mY = 0, mAvailSpaceRect = {x = 0, 
    y = 0, width = 10095, height = 1073741824}, mKidXMost = 0, 
  mFloaterCombinedArea = {x = 0, y = 0, width = 0, height = 0}, 
  mHaveRightFloaters = 0, mRightFloaterCombinedArea = {x = 0, y = 0, 
    width = 0, height = 0}, mFloaterCacheFreeList = {<nsFloaterCacheList> = {
      mHead = 0x0}, mTail = 0x0}, mPrevChild = 0x0, mNextRCFrame = 0x88dde84, 
  mPrevBottomMargin = 0, mNextInFlow = 0x0, mBand = {<nsBandData> = {
      mCount = 1, mSize = 6, mTrapezoids = 0xbfffe644}, 
    mSpaceManager = 0x8963c28, mSpaceManagerX = 0, mSpaceManagerY = 0, 
    mSpace = {width = 10095, height = 1073741824}, mData = {{mTopY = 0, 
        mBottomY = 1073741824, mTopLeftX = 0, mBottomLeftX = 0, 
        mTopRightX = 10095, mBottomRightX = 10095, mState = Available, {
          mFrame = 0x0, mFrames = 0x0}}, {mTopY = 0, mBottomY = 0, 
        mTopLeftX = 0, mBottomLeftX = 0, mTopRightX = 0, mBottomRightX = 0, 
        mState = 2332384, {mFrame = 0x0, mFrames = 0x0}}, {mTopY = 0, 
        mBottomY = 0, mTopLeftX = 0, mBottomLeftX = 0, mTopRightX = 0, 
        mBottomRightX = 0, mState = 2622080, {mFrame = 0x0, mFrames = 0x0}}, {
        mTopY = 0, mBottomY = 0, mTopLeftX = 0, mBottomLeftX = 0, 
        mTopRightX = 0, mBottomRightX = 0, mState = 3221219068, {mFrame = 0x0, 
          mFrames = 0x0}}, {mTopY = 0, mBottomY = 0, mTopLeftX = 0, 
        mBottomLeftX = 0, mTopRightX = 0, mBottomRightX = 0, 
        mState = 136032664, {mFrame = 0x0, mFrames = 0x0}}, {mTopY = 0, 
        mBottomY = 0, mTopLeftX = 0, mBottomLeftX = 0, mTopRightX = 0, 
        mBottomRightX = 0, mState = 3221219116, {mFrame = 0x0, 
          mFrames = 0x0}}}, mAvailSpace = {x = 0, y = 0, width = 10095, 
      height = 1073741824}, mLeftFloaters = 0, mRightFloaters = 0}, 
  mCurrentLineFloaters = {<nsFloaterCacheList> = {mHead = 0x0}, mTail = 0x0}, 
  mBelowCurrentLineFloaters = {<nsFloaterCacheList> = {mHead = 0x0}, 
    mTail = 0x0}, mMaxElementSize = {width = 0, height = 0}, 
  mMaximumWidth = 0, mMinLineHeight = 225, mLineNumber = 0, mFlags = 450}
        rv = 0
        isStyleChange = 0
        target = (nsIFrame *) 0x88de0d8
        verifyReflowFlags = 143515344
#8  0x015f2915 in nsContainerFrame::ReflowChild (this=0x88dd164, 
    aKidFrame=0x88dde38, aPresContext=0x8704940, aDesiredSize=@0xbfffe978, 
    aReflowState=@0xbfffe8d8, aX=0, aY=0, aFlags=0, aStatus=@0xbfffeca0)
    at nsContainerFrame.cpp:693
        this = (nsContainerFrame *) 0x88dd164
        result = 143511908
        saveMaxElementSize = (nsSize *) 0x0
#9  0x0160d26a in CanvasFrame::Reflow (this=0x88dd164, aPresContext=0x8704940, 
    aDesiredSize=@0xbfffec6c, aReflowState=@0xbfffea98, aStatus=@0xbfffeca0)
    at nsHTMLFrame.cpp:301
        kidFrame = (nsIFrame *) 0x88dde38
        kidReflowState = {parentReflowState = 0xbfffea98, frame = 0x88dde38, 
  reason = eReflowReason_Incremental, reflowCommand = 0x88ff548, 
  availableWidth = 10095, availableHeight = 1073741824, 
  rendContext = 0x89fd928, isTopOfPage = 0 '\000', mFrameType = 2, 
  mSpaceManager = 0x8963c28, mLineLayout = 0x0, mComputedWidth = 10095, 
  mComputedHeight = 1073741824, mComputedMargin = {left = 0, top = 0, 
    right = 0, bottom = 0}, mComputedBorderPadding = {left = 0, top = 0, 
    right = 0, bottom = 0}, mComputedPadding = {left = 0, top = 0, right = 0, 
    bottom = 0}, mComputedOffsets = {left = 0, top = 0, right = 0, 
    bottom = 0}, mComputedMinWidth = 0, mComputedMaxWidth = 1073741824, 
  mComputedMinHeight = 0, mComputedMaxHeight = 1073741824, 
  mCompactMarginWidth = 0, mAlignCharOffset = 0, 
  mUseAlignCharOffset = 0 '\000', mStyleDisplay = 0x88e96a0, 
  mStylePosition = 0x88e961c, mStyleSpacing = 0x88e9528, mReflowDepth = 3}
        border = {left = 23144444, top = -1073747724, right = 1, 
  bottom = -1073747700}
        kidState = 143515864
        rect = {x = 1, y = 2622080, width = 1942686, height = 1534036}
        this = (CanvasFrame *) 0x88dd164
        isStyleChange = 0
        isDirtyChildReflow = 0
        kidDesiredSize = {width = 0, height = 0, ascent = 0, descent = 0, 
  maxElementSize = 0x0, mMaximumWidth = 0, mCarriedOutBottomMargin = 0, 
  mOverflowArea = {x = 0, y = 0, width = 0, height = 0}, mFlags = 0, 
  mNothingChanged = 0}
#10 0x0180f703 in nsBoxToBlockAdaptor::Reflow (this=0x88dddd0, 
    aState=@0xbffff148, aPresContext=0x8704940, aDesiredSize=@0xbfffec6c, 
    aReflowState=@0xbffff2ac, aStatus=@0xbfffeca0, aX=0, aY=0, aWidth=10095, 
    aHeight=9375, aMoveFrame=1) at nsBoxToBlockAdaptor.cpp:811
        border = {left = 0, top = 0, right = 0, bottom = 0}
        size = {width = 10095, height = 9375}
        reflowState = {parentReflowState = 0xbffff2ac, frame = 0x88dd164, 
  reason = eReflowReason_Incremental, reflowCommand = 0x88ff548, 
  availableWidth = 10095, availableHeight = 1073741824, 
  rendContext = 0x89fd928, isTopOfPage = 0 '\000', mFrameType = 2, 
  mSpaceManager = 0x88ea400, mLineLayout = 0x0, mComputedWidth = 10095, 
  mComputedHeight = 9375, mComputedMargin = {left = 0, top = 0, right = 0, 
    bottom = 0}, mComputedBorderPadding = {left = 0, top = 0, right = 0, 
    bottom = 0}, mComputedPadding = {left = 0, top = 0, right = 0, 
    bottom = 0}, mComputedOffsets = {left = 0, top = 0, right = 0, 
    bottom = 0}, mComputedMinWidth = 0, mComputedMaxWidth = 1073741824, 
  mComputedMinHeight = 0, mComputedMaxHeight = 1073741824, 
  mCompactMarginWidth = 0, mAlignCharOffset = 0, 
  mUseAlignCharOffset = 0 '\000', mStyleDisplay = 0x88e6650, 
  mStylePosition = 0x88e65cc, mStyleSpacing = 0x88e64d8, mReflowDepth = 2}
        kidState = 141627288
        rv = 143511908
        lines = {mRawPtr = 0x276f}
        changedSize = 3807492
        parent = (nsIBox *) 0x88dd27c
        frame = (nsIFrame *) 0x88dd244
        frameState = 549466116
        nonConstState = (nsHTMLReflowState &) @0xbffff2ac: {
  parentReflowState = 0xbffff41c, frame = 0x88dd1a0, 
  reason = eReflowReason_Incremental, reflowCommand = 0x88ff548, 
  availableWidth = 10095, availableHeight = 9375, rendContext = 0x89fd928, 
  isTopOfPage = 0 '\000', mFrameType = 2, mSpaceManager = 0x88ea400, 
  mLineLayout = 0x0, mComputedWidth = 10095, mComputedHeight = 9375, 
  mComputedMargin = {left = 0, top = 0, right = 0, bottom = 0}, 
  mComputedBorderPadding = {left = 0, top = 0, right = 0, bottom = 0}, 
  mComputedPadding = {left = 0, top = 0, right = 0, bottom = 0}, 
  mComputedOffsets = {left = 0, top = 0, right = 0, bottom = 0}, 
  mComputedMinWidth = 0, mComputedMaxWidth = 1073741824, 
  mComputedMinHeight = 0, mComputedMaxHeight = 1073741824, 
  mCompactMarginWidth = 0, mAlignCharOffset = 0, 
  mUseAlignCharOffset = 0 '\000', mStyleDisplay = 0x88de5f8, 
  mStylePosition = 0x88de574, mStyleSpacing = 0x88de480, mReflowDepth = 1}
        needsReflow = 1
        reason = eReflowReason_Incremental
        childState = 9216
#11 0x0180ee37 in nsBoxToBlockAdaptor::DoLayout (this=0x88dddd0, 
    aState=@0xbffff148) at nsBoxToBlockAdaptor.cpp:484
        currentSize = (nsSize *) 0x0
        size = {width = 0, height = 0}
        origWidth = 10095
        collapsed = 28563988
        this = (nsBoxToBlockAdaptor *) 0x88dddd0
        ourRect = {x = 0, y = 0, width = 10095, height = 9375}
        reflowState = (nsHTMLReflowState *) 0xbffff2ac
        presContext = (nsIPresContext *) 0x8704940
        status = 0
        desiredSize = {width = 0, height = 0, ascent = 0, descent = 0, 
  maxElementSize = 0x0, mMaximumWidth = 0, mCarriedOutBottomMargin = 0, 
  mOverflowArea = {x = 0, y = 0, width = 0, height = 0}, mFlags = 0, 
  mNothingChanged = 0}
        rv = 3221220860
#12 0x0180c1e5 in nsBox::Layout (this=0x88dddd0, aState=@0xbffff148)
    at nsBox.cpp:1000
        this = (nsBox *) 0x88dddd0
#13 0x017f4588 in nsScrollBoxFrame::DoLayout (this=0x88dd244, 
    aState=@0xbffff148) at nsScrollBoxFrame.cpp:375
        oldflags = 0
        clientRect = {x = 0, y = 0, width = 10095, height = 9375}
        kid = (nsIBox *) 0x88dddd0
        childRect = {x = 0, y = 0, width = 10095, height = 9375}
        margin = {left = 0, top = 0, right = 0, bottom = 0}
        presContext = (nsIPresContext *) 0x8704940
        adaptor = {mRawPtr = 0x88ddde0}
        flags = 5
        scrollingView = (nsIScrollableView *) 0x1b3da14
        view = (nsIView *) 0x88dd27c
        scrollPort = {x = 23011203, y = 141608392, width = 143548672, 
  height = 0}
        vertChanged = -1073746404
        horizChanged = 0
        shell = {mRawPtr = 0x2aaa64}
#14 0x0180c1e5 in nsBox::Layout (this=0x88dd27c, aState=@0xbffff148)
    at nsBox.cpp:1000
        this = (nsBox *) 0x88dd27c
#15 0x01811a97 in nsContainerBox::LayoutChildAt (aState=@0xbffff148, 
    aBox=0x88dd27c, aRect=@0xbffff01c) at nsContainerBox.cpp:593
        oldRect = {x = 0, y = 0, width = 10095, height = 9375}
        dirty = 0
        dirtyChildren = 4096
        layout = 1
#16 0x01650bdb in nsGfxScrollFrameInner::LayoutBox (this=0x87ba5b0, 
    aState=@0xbffff148, aBox=0x88dd27c, aRect=@0xbffff01c)
    at nsGfxScrollFrame.cpp:1003
        this = (nsGfxScrollFrameInner *) 0x87ba5b0
#17 0x01650e3f in nsGfxScrollFrameInner::Layout (this=0x87ba5b0, 
    aState=@0xbffff148) at nsGfxScrollFrame.cpp:1083
        this = (nsGfxScrollFrameInner *) 0x87ba5b0
        scrollBarRight = 1
        scrollBarBottom = 1
        frame = (nsIFrame *) 0x88dd1a0
        styleDisplay = (nsStyleDisplay *) 0x88de5f8
        clientRect = {x = 0, y = 0, width = 10095, height = 9375}
        hSize = {width = 0, height = 0}
        vSize = {width = 0, height = 0}
        hMinSize = {width = 0, height = 0}
        vMinSize = {width = 0, height = 0}
        scrollAreaRect = {x = 0, y = 0, width = 10095, height = 9375}
        needsLayout = 28521320
        scrolledContentSize = {width = 25222934, height = 25214528}
        presContext = (nsIPresContext *) 0xbffff148
        p2t = 6.6067142e-38
        font = (nsStyleFont *) 0x17f618e
        f = (nsFont &) @0x180a5f0: {
  name = {<basic_nsAWritableString<short unsigned int>> = 
{<basic_nsAReadableString<short unsigned int>> = {
        _vptr. = 0x83e58955}, <No data fields>}, <nsStr> = {
      mLength = 1448570092, mCapacity = 59475, mCharSize = 2170224640, 
      mOwnsBuffer = 859051715, {mStr = 0x87d8b00 ",", 
        mUStr = 0x87d8b00}}, <No data fields>}, style = 131 '\203', 
  variant = 196 'Ä', weight = 35828, decorations = 7 '\a', size = -1957232640}
        fm = {mRawPtr = 0x17f6180}
        fontHeight = 28563988
        maxX = 25208318
        maxY = 143515088
        scrollable = (nsIScrollableView *) 0x2
        vRect = {x = 28563988, y = -1073745900, width = 26275464, 
  height = 28563988}
        hRect = {x = 25210268, y = 0, width = 25212876, height = -1073745844}
#18 0x01650c3d in nsGfxScrollFrame::DoLayout (this=0x88dd19c, 
    aState=@0xbffff148) at nsGfxScrollFrame.cpp:1011
        this = (nsGfxScrollFrame *) 0x88dd19c
        flags = 0
        rv = 28563988
#19 0x0180c1e5 in nsBox::Layout (this=0x88dd1d8, aState=@0xbffff148)
    at nsBox.cpp:1000
        this = (nsBox *) 0x88dd1d8
#20 0x01820f1b in nsBoxFrame::Reflow (this=0x88dd1a0, aPresContext=0x8704940, 
    aDesiredSize=@0xbffff354, aReflowState=@0xbffff2ac, aStatus=@0xbffff4bc)
    at nsBoxFrame.cpp:725
        this = (nsBoxFrame *) 0x88dd1a0
        state = {mPresContext = {mRawPtr = 0x8704940}, 
  mReflowState = 0xbffff2ac, mType = Dirty, mMaxElementSize = 0x0, 
  mOverFlowSize = {width = 0, height = 0}, mIncludeOverFlow = 1, 
  mLayoutFlags = 5, _vptr. = 0x1b33240}
        computedSize = {width = 10095, height = 9375}
        m = {left = 0, top = 0, right = 0, bottom = 0}
        prefSize = {width = 0, height = 0}
        r = {x = 0, y = 0, width = 10095, height = 9375}
        ascent = 1534036
        maxElementSize = (nsSize *) 0x1da49e
#21 0x0164fece in nsGfxScrollFrame::Reflow (this=0x88dd19c, 
    aPresContext=0x8704940, aDesiredSize=@0xbffff354, 
    aReflowState=@0xbffff2ac, aStatus=@0xbffff4bc) at nsGfxScrollFrame.cpp:719
        this = (nsGfxScrollFrame *) 0x88dd19c
        rv = 26291031
#22 0x015f2915 in nsContainerFrame::ReflowChild (this=0x88dd128, 
    aKidFrame=0x88dd1a0, aPresContext=0x8704940, aDesiredSize=@0xbffff354, 
    aReflowState=@0xbffff2ac, aX=0, aY=0, aFlags=0, aStatus=@0xbffff4bc)
    at nsContainerFrame.cpp:693
        this = (nsContainerFrame *) 0x88dd128
        result = 143511848
        saveMaxElementSize = (nsSize *) 0x0
Ok, so after two assertions in nsBoxToBlockAdaptor::Reflow:

###!!! ASSERTION: bad status: 'NS_FRAME_IS_COMPLETE(aStatus)', file 
nsBoxToBlockAdaptor.cpp, line 813

we hit these three assertions in nsBlockFrame::DoRemoveFrame, 
the last of which is fatal:

###!!! ASSERTION: can't find deleted frame in lines: 'nsnull != line', file 
nsBlockFrame.cpp, line 5468 

###!!! ASSERTION: bad prevSibling: 'tmp == aDeletedFrame', file 
nsBlockFrame.cpp, line 5472 

###!!! ASSERTION: whoops, continuation without a parent: 'nsnull != flow', file 
nsBlockFrame.cpp, line 5586

because we are accessing flow immediately afterwards:

5583    // Advance to next flow block if the frame has more continuations
5584    if (nsnull != aDeletedFrame) {
5585      flow = (nsBlockFrame*) flow->mNextInFlow;
5586      NS_ASSERTION(nsnull != flow, "whoops, continuation without a parent");
5587      prevLine = nsnull;
5588      line = flow->mLines;
5589      linep = &flow->mLines;
5590      prevSibling = nsnull;
5591    }

Buster, Waqar, how would you start to debug this? Which is the first of these
assertions that is considered "fatal"? Does anything in the stack trace ring a
bell? Is there a way to dump the content model?

Dameon, are the assertions described above what you are seeing?
Maybe you can create a more minimal testcase from the mozillazine page?
I still cant get it crash on my machine RedHat Linux 6.2, I don't dont have
Mandrake to test with. It may be specific to Mandrake 7.1 only as the user is
using that. I am using 7/19 build. I went to mozillazine page atleast 5 times
and clicked on the links and other typical browsing.

At the suggestion of my boss, I am removing nsbeta2+ since it only happens on
Mandrake 7.1 Linux, we only support RedHat at this moment and we don't have a
bug owner of other linux versions.
Status: REOPENED → ASSIGNED
Keywords: nsbeta2
Whiteboard: [nsbeta2+]
Target Milestone: --- → Future
Yes, I am seeing those assertions when I do this.

Mandrake is generally redhat, though they optimize for 586 instead of 386 and 
include some more "cutting edge" stuff. I don't think it's that different. I'm 
guessing this bug is probably more unique to my configuration somehow (other 
Mandrake users reportedly don't have this problem), I just wish I knew what it 
was. :-)
*** Bug 45691 has been marked as a duplicate of this bug. ***
This appears to work now in build 2000090506. Hopefully, this bug won't occur
again. :-)
seems to work fine for me as well.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago → 24 years ago
Resolution: --- → WORKSFORME
Works for me in the Sept 14th Linux build.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.