I've been experiencing Mozilla crashes as well, and today I finally got a core
dump. I'm not doing opening any special page, but it just crashes after days of
uptime.

Mozilla is started with this to get the core dump:
$ MOZILLA_FIVE_HOME="/usr/lib/mozilla-1.7.10" LD_LIBRARY_PATH="
/usr/lib/mozilla-1.7.10:/usr/lib/mozilla-1.7.10/plugins"
/usr/lib/mozilla-1.7.10/mozilla-bin &

Several days later, this is spewed to stderr before crash:

looking for type: got text/plain
Error: Bad bounding box in Type 3 glyph
Error: Bad bounding box in Type 3 glyph
Error: Bad bounding box in Type 3 glyph
Error: Bad bounding box in Type 3 glyph
...
[this error is repeated 74 times in total]

gdb backtrace is here:

$ MOZILLA_FIVE_HOME="/usr/lib/mozilla-1.7.10"
LD_LIBRARY_PATH="/usr/lib/mozilla-1.7.10:/usr
/lib/mozilla-1.7.10/plugins" gdb /usr/lib/mozilla-1.7.10/mozilla-bin  core.10080
GNU gdb Red Hat Linux (6.1post-1.20040607.43rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...(no debugging symbols
found)...Using h
ost libthread_db library "/lib/tls/libthread_db.so.1".

Reading symbols from shared object read from target memory...(no debugging
symbols found)..
.done.
Loaded system supplied DSO at 0xb7fe3000
Core was generated by `/usr/lib/mozilla-1.7.10/mozilla-bin'.
Program terminated with signal 11, Segmentation fault.

warning: svr4_current_sos: Can't read pathname for load map: Input/output error

Reading symbols from /usr/lib/mozilla-1.7.10/libmozjs.so...(no debugging symbols
found)...d
one.
...
Loaded symbols for /usr/lib/gnome-vfs-2.0/modules/libfile.so
Reading symbols from /usr/lib/libfam.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libfam.so.0
#0  0xb7fe3402 in __kernel_vsyscall ()
(gdb) bt
#0  0xb7fe3402 in __kernel_vsyscall ()
#1  0x00c77624 in raise () from /lib/tls/libpthread.so.0
#2  0xb6b9ee02 in NSGetModule () from
/usr/lib/mozilla-1.7.10/components/libprofile.so
#3  <signal handler called>
#4  0xb7f9eef7 in JS_HashTableRawLookup () from /usr/lib/mozilla-1.7.10/libmozjs.so
#5  0xb7f847ce in js_IndexAtom () from /usr/lib/mozilla-1.7.10/libmozjs.so
#6  0xb7f91a32 in js_LookupCompileTimeConstant () from
/usr/lib/mozilla-1.7.10/libmozjs.so
#7  0xb7f93513 in js_EmitTree () from /usr/lib/mozilla-1.7.10/libmozjs.so
#8  0xb7f97db8 in js_EmitTree () from /usr/lib/mozilla-1.7.10/libmozjs.so
#9  0xb7f93545 in js_EmitTree () from /usr/lib/mozilla-1.7.10/libmozjs.so
#10 0xb7f942db in js_EmitTree () from /usr/lib/mozilla-1.7.10/libmozjs.so
#11 0xb7f94726 in js_EmitTree () from /usr/lib/mozilla-1.7.10/libmozjs.so
#12 0xb7fbd482 in js_FoldConstants () from /usr/lib/mozilla-1.7.10/libmozjs.so
#13 0xb7fc1be9 in js_CompileTokenStream () from /usr/lib/mozilla-1.7.10/libmozjs.so
#14 0xb7f7d463 in JS_DefineUCFunction () from /usr/lib/mozilla-1.7.10/libmozjs.so
#15 0xb7f7d4ef in JS_CompileUCScriptForPrincipals ()
   from /usr/lib/mozilla-1.7.10/libmozjs.so
#16 0xb7f7dd3c in JS_EvaluateUCScriptForPrincipals ()
   from /usr/lib/mozilla-1.7.10/libmozjs.so
#17 0xb7a31d4e in NSGetModule () from
/usr/lib/mozilla-1.7.10/components/libgklayout.so
#18 0xb78f4aa5 in NSGetModule () from
/usr/lib/mozilla-1.7.10/components/libgklayout.so
#19 0xb78f55fc in NSGetModule () from
/usr/lib/mozilla-1.7.10/components/libgklayout.so
#20 0xb78f70fe in NSGetModule () from
/usr/lib/mozilla-1.7.10/components/libgklayout.so
#21 0xb7b73769 in NSGetModule () from /usr/lib/mozilla-1.7.10/components/libnecko.so
---Type <return> to continue, or q <return> to quit---
#22 0xb7b732a5 in NSGetModule () from /usr/lib/mozilla-1.7.10/components/libnecko.so
#23 0xb7be0a57 in NSGetModule () from /usr/lib/mozilla-1.7.10/components/libnecko.so
#24 0xb7b5c9f9 in NSGetModule () from /usr/lib/mozilla-1.7.10/components/libnecko.so
#25 0xb7b5cdc2 in NSGetModule () from /usr/lib/mozilla-1.7.10/components/libnecko.so
#26 0xb7ccc5d3 in nsInputStreamReadyEvent::EventHandler ()
   from /usr/lib/mozilla-1.7.10/libxpcom.so
#27 0xb7ce0a8f in PL_HandleEvent () from /usr/lib/mozilla-1.7.10/libxpcom.so
#28 0xb7ce1219 in PL_ProcessPendingEvents () from
/usr/lib/mozilla-1.7.10/libxpcom.so
#29 0xb7ce27be in nsEventQueueImpl::NotifyObservers ()
   from /usr/lib/mozilla-1.7.10/libxpcom.so
#30 0xb6bcde66 in ?? () from /usr/lib/mozilla-1.7.10/components/libwidget_gtk2.so
#31 0x089e9b80 in ?? ()
#32 0x00de9ca0 in ?? () from /usr/lib/libglib-2.0.so.0
#33 0xbfee2528 in ?? ()
#34 0x00daccea in g_static_private_get () from /usr/lib/libglib-2.0.so.0
#35 0x00db69c7 in g_vasprintf () from /usr/lib/libglib-2.0.so.0
#36 0x00d927bb in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#37 0x00d94242 in g_main_context_acquire () from /usr/lib/libglib-2.0.so.0
#38 0x00d944ef in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#39 0x0045bf97 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#40 0xb6bce588 in ?? () from /usr/lib/mozilla-1.7.10/components/libwidget_gtk2.so
#41 0x08065258 in ?? ()
#42 0x00000000 in ?? ()

Could this be FC3 specific? 

I'm saving the core file if more information is needed.

-Mikko

Thanks Mikko, nice work.

About this being an FC3 issue: I was still experiencing this with FC4 release
with Firefox.  After days of browsing and having approximately 4 Firefox windows
each with about 30 tabs, I would attempt to open another Firefox instance.  The
machine would churn for about 5-10 seconds, then all the Firefox instances would
abruptly close/crash without warning.

Still testing this with Firefox 1.0.4 and updated FC4...

Fedora Core 3 is now maintained by the Fedora Legacy project for security
updates only. If this problem is a security issue, please reopen and
reassign to the Fedora Legacy product. If it is not a security issue and
hasn't been resolved in the current FC5 updates or in the FC6 test
release, reopen and change the version to match.

Thank you!

Reporter, could you confirm please, that this bug still could be reproduced with
the updated release of the supported version of Fedora (FC5, FC6, or F7)?

If yes, please, reopen this bug with additional information how it is possible
to reproduce this bug.

In meantime, I have to close this bug as CANTFIX, because it is reported against
not longer supported distribution.

Thanks in advance.