Another crash log:

Program received signal SIGABRT, Aborted.
0x0000003ce2432215 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64        return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
#0  0x0000003ce2432215 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x0000003ce2433d83 in abort () at abort.c:88
#2  0x0000003ce2472858 in __libc_message (do_abort=<value optimized out>,
    fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
#3  0x0000003ce2478158 in malloc_printerr (action=<value optimized out>,
    str=<value optimized out>, ptr=<value optimized out>) at malloc.c:5949
#4  0x0000003ce247a796 in __libc_free (mem=<value optimized out>) at malloc.c:3625
#5  0x000000000118af9e in nsAccessNode::Release (this=0x7023) at
nsAccessNode.cpp:120
#6  0x0000000001190e9c in nsDocAccessible::FlushPendingEvents (this=0x7f011c2028d0)
    at nsDocAccessible.cpp:1640
#7  0x000000000122350e in nsTimerImpl::Fire (this=0x7f0117c3a470)
    at nsTimerImpl.cpp:400
#8  0x0000000001223575 in nsTimerEvent::Run (this=<value optimized out>)
    at nsTimerImpl.cpp:490
#9  0x00000000012210ca in nsThread::ProcessNextEvent (this=0x2579060, mayWait=1,
    result=0x7fff2d2b4c9c) at nsThread.cpp:510
#10 0x00000000011f2922 in NS_ProcessNextEvent_P (thread=0x7023, mayWait=1)
    at nsThreadUtils.cpp:227
#11 0x000000000116a739 in nsBaseAppShell::Run (this=0x2659ac0)
    at nsBaseAppShell.cpp:170
#12 0x000000000102d97d in nsAppStartup::Run (this=0x7f0120647090)
    bat nsAppStartup.cpp:181
#13 0x0000000000a29afb in XRE_main (argc=<value optimized out>,
    argv=<value optimized out>, aAppData=<value optimized out>)
    at nsAppRunner.cpp:3154
#14 0x0000000000401665 in __gxx_personality_v0 ()
    at ../../../../libstdc++-v3/libsupc++/eh_personality.cc:363
#15 0x0000003ce241e32a in __libc_start_main (main=<value optimized out>,
    argc=<value optimized out>, ubp_av=<value optimized out>,

Still happens with 3.0-1 & xulrunner-1.9-1.

General trigger is:

1) have more than one tab
2) have a logged-in gmail window in one of those tabs
3) close said tab

Weird, by following steps from comment 2 I cannot reproduce -- it just closes
GMail window. Any interesting plugins (try to run with -safe-mode)?

safe-mode does not crash.

Disabling all add-ons (AdblockPlus, CustomizeGoogle) and plugins (flash,
standard totem set, gcj) by hand and doing it still crashes.

(In reply to comment #4)
> safe-mode does not crash.
> 
> Disabling all add-ons (AdblockPlus, CustomizeGoogle) and plugins (flash,
> standard totem set, gcj) by hand and doing it still crashes.

Still the same backtrace?

ASSIGNing to caillon and martin.

Also, the trace indicates this is a11y related.  I'd wager that turning off a11y
gets it to not crash... 

Haven't seen it since turning off a11y a while ago.

Created attachment 311044 [details]
Valgrind log

Hi,

I was also having stability issues with Firefox 3. To find out more of the
cause of these crashes I've run Firefox 3 through valgrind to detect invalid
memory usage.

From line 1043 on there are several 'invalid read' actions which are caused by
Firefox/Xulrunner (the ones earlier are glibc dlopen bugs I think). The
backtrace given earlier in this report is also present and marked as an
'invalid read' action. There's also an invalid free/delete in this log which
would cause Firefox to crash frequently.

This valgrind log is created on a up-to-date rawhide system

Erik, please, file a separate bug for this and don't hijack this bug.

We have registered this bug in the upstream database
(https://bugzilla.mozilla.org/show_bug.cgi?id=443637) and believe that it is
more appropriate to let it be resolved upstream.

Red Hat will continue to track the issue in the centralized upstream bug
tracker, and will review any bug fixes that become available for consideration
in future updates.

Thank you for the bug report.