I've just added this assertion in bug 458636. I triggers when loading the mochitest: content/tests/widgets/test_popupremoving.xul ###!!! ASSERTION: GetPrimaryFrameFor() called while frames are being destroyed!: '!mIsDestroyingFrames', file /usr/moz/hg3/layout/base/nsFrameManager.cpp, line 328 This usually means there's a path to a bad crash (using freed frames or such). I don't know if that's the case here or if it's harmless, but I'm filing the bug as security-sensitive just in case.
Created attachment 342817 [details] stack for the "killing mutation events" assertion test_popupremoving.xul also triggers: ASSERTION: killing mutation events: 'nsContentUtils::IsSafeToRunScript()', file ../../../dist/include/content/nsContentUtils.h, line 1512 Here's the stack for that assertion.
> ###!!! ASSERTION: GetPrimaryFrameFor() called while frames are being > destroyed!: '!mIsDestroyingFrames', file > /usr/moz/hg3/layout/base/nsFrameManager.cpp, line 328 This assertion was removed in rev e9921507713b: user: Boris Zbarsky date: Thu Dec 24 16:20:06 2009 -0500 summary: Bug 500882 part 7. Remove the old GetPrimaryFrameFor API. r=roc, sr=dbaron
Yeah, that bug's fix got rid of the whole class of "dangling frame pointer mapped to a content node" issues.
test_popupremoving doesn't trigger any assertions now :) http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268460426.1268461747.4378.gz&fulltext=1