I cannot reproduce it here (actually there is not much you would write about ways how to reproduce it). If you can describe some more details about your configuration, network configuration, URL where it happens, etc., so that we are able to reproduce it here.

Otherwise, if we cannot get that information in a month, I will have no way how to react, than to close this as WORKSFORME.

Yeah, I'm afraid it's not like it's a repetetive crash whenever I browse to a particular website.  It's more random than that.   If I could figure out how to get firefox to drop a core file I'd gladly upload that for you.  I could also give you my sessionstore.js, but I'd rather do that privately.  But it's definitely something that happens regularly on my system, but as I said I've got something like 40-50 windows and a total over 150 tabs open.  I can certainly try to do more debugging from here when it crashes if there's something that would help you?

well, that's a lot of windows and a lot of tabs -- are you sure there is no OOM or something of that sort involved? Otherwise, let's give you a month, and try to show me the way how to reproduce it or produce correct backtrace, right?

Yes, it's a lot of windows and a lot of tabs.  And yes, I'm sure it's not an OOM.  I have plenty of swap space:

             total       used       free     shared    buffers     cached
Mem:       3105192    1875040    1230152          0      24040     874924
-/+ buffers/cache:     976076    2129116
Swap:      5478124     423308    5054816

After filing this bug it crashed a couple more times but both times it was in the flashplayer...  So I removed that plugin, installed gnash instead, and ran it..  Then overnight last night it crashed.  I can't tell you what it was doing because I was asleep!  Here's the backtrace I got this morning.   Note, if this backtrace is not sufficient please tell me what I can do to get you a "correct backtrace".  What info are you missing from the backtrace?  What additional info do you need?

[Thread 0x6fdfcb90 (LWP 17587) exited]
[New Thread 0x6fdfcb90 (LWP 17596)]
[Thread 0x6fdfcb90 (LWP 17596) exited]

Program received signal SIGSEGV, Segmentation fault.
GCGraphBuilder::AddNode (this=0xbf854f78, s=0x1dfcd4c0, aParticipant=0x90bf5dc)
    at nsCycleCollector.cpp:1287
1287	    if (!e->mNode) {
Missing separate debuginfos, use: debuginfo-install gnash-plugin-0.8.4-5.fc10.i386 libbeagle-0.3.5-1.fc9.i386 libthai-0.1.9-4.fc9.i386 totem-mozplugin-2.24.3-1.fc10.i386 totem-pl-parser-2.24.3-1.fc10.i386
(gdb) t a a bt

Thread 8 (Thread 0xb7e35b90 (LWP 2086)):
#0  0x00c74416 in __kernel_vsyscall ()
#1  0x0076a777 in poll () from /lib/libc.so.6
#2  0x0691cca4 in ?? () from /lib/libnspr4.so
#3  0x0362159b in nsSocketTransportService::Poll (this=0x90acf00, wait=1, 
    interval=0xb7e351d8) at nsSocketTransportService2.cpp:349
#4  0x03621ab0 in nsSocketTransportService::DoPollIteration (this=0x90acf00, 
    wait=1) at nsSocketTransportService2.cpp:644
#5  0x03621d6c in nsSocketTransportService::OnProcessNextEvent (
    this=0x90acf00, thread=0x90ad5d8, mayWait=1, depth=1)
    at nsSocketTransportService2.cpp:523
#6  0x03e0eed0 in nsThread::ProcessNextEvent (this=0x90ad5d8, mayWait=1, 
    result=0xb7e35284) at nsThread.cpp:497
#7  0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x1, mayWait=1)
    at nsThreadUtils.cpp:227
#8  0x036217c7 in nsSocketTransportService::Run (this=0x90acf00)
    at nsSocketTransportService2.cpp:565
#9  0x03e0ef2c in nsThread::ProcessNextEvent (this=0x90ad5d8, mayWait=1, 
    result=0xb7e35334) at nsThread.cpp:510
#10 0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x1, mayWait=1)
    at nsThreadUtils.cpp:227
#11 0x03e0f7e2 in nsThread::ThreadFunc (arg=0x90ad5d8) at nsThread.cpp:254
---Type <return> to continue, or q <return> to quit---
#12 0x069210d1 in ?? () from /lib/libnspr4.so
#13 0x0083f51f in start_thread () from /lib/libpthread.so.0
#14 0x0077504e in clone () from /lib/libc.so.6

Thread 7 (Thread 0xb7434b90 (LWP 2087)):
#0  0x00c74416 in __kernel_vsyscall ()
#1  0x00843432 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
#2  0x06919f1e in ?? () from /lib/libnspr4.so
#3  0x0691ad40 in PR_WaitCondVar () from /lib/libnspr4.so
#4  0x03e125a0 in TimerThread::Run (this=0x9031400) at TimerThread.cpp:345
#5  0x03e0ef2c in nsThread::ProcessNextEvent (this=0x91ec348, mayWait=1, 
    result=0xb7434334) at nsThread.cpp:510
#6  0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x80, mayWait=1)
    at nsThreadUtils.cpp:227
#7  0x03e0f7e2 in nsThread::ThreadFunc (arg=0x91ec348) at nsThread.cpp:254
#8  0x069210d1 in ?? () from /lib/libnspr4.so
#9  0x0083f51f in start_thread () from /lib/libpthread.so.0
#10 0x0077504e in clone () from /lib/libc.so.6

Thread 6 (Thread 0xb35ffb90 (LWP 2100)):
#0  0x00c74416 in __kernel_vsyscall ()
#1  0x00843105 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
---Type <return> to continue, or q <return> to quit---
#2  0x0691adb7 in PR_WaitCondVar () from /lib/libnspr4.so
#3  0x03c140c3 in nsSSLThread::Run (this=0xa5fa118) at nsSSLThread.cpp:964
#4  0x03c139da in nsPSMBackgroundThread::nsThreadRunner (arg=0xa5fa118)
    at nsPSMBackgroundThread.cpp:44
#5  0x069210d1 in ?? () from /lib/libnspr4.so
#6  0x0083f51f in start_thread () from /lib/libpthread.so.0
#7  0x0077504e in clone () from /lib/libc.so.6

Thread 5 (Thread 0xb5affb90 (LWP 2101)):
#0  0x00c74416 in __kernel_vsyscall ()
#1  0x00843105 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x0691adb7 in PR_WaitCondVar () from /lib/libnspr4.so
#3  0x03c15231 in nsCertVerificationThread::Run (this=0xa5fa2c0)
    at nsCertVerificationThread.cpp:138
#4  0x03c139da in nsPSMBackgroundThread::nsThreadRunner (arg=0xa5fa2c0)
    at nsPSMBackgroundThread.cpp:44
#5  0x069210d1 in ?? () from /lib/libnspr4.so
#6  0x0083f51f in start_thread () from /lib/libpthread.so.0
#7  0x0077504e in clone () from /lib/libc.so.6

Thread 4 (Thread 0xb21fdb90 (LWP 2102)):
#0  0x00c74416 in __kernel_vsyscall ()
#1  0x00843105 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
---Type <return> to continue, or q <return> to quit---
#2  0x0691adb7 in PR_WaitCondVar () from /lib/libnspr4.so
#3  0x0691ae37 in PR_Wait () from /lib/libnspr4.so
#4  0x03e0e055 in nsAutoMonitor::Wait ()
    at ../../dist/include/xpcom/nsAutoLock.h:340
#5  nsEventQueue::GetEvent (this=0xa64f760, mayWait=1, result=0xb21fd2f4)
    at nsEventQueue.cpp:85
#6  0x03e0ef02 in nsThread::nsChainedEventQueue::GetEvent () at nsThread.h:112
#7  nsThread::ProcessNextEvent (this=0xa64f740, mayWait=1, result=0xb21fd334)
    at nsThread.cpp:501
#8  0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x80, mayWait=1)
    at nsThreadUtils.cpp:227
#9  0x03e0f7e2 in nsThread::ThreadFunc (arg=0xa64f740) at nsThread.cpp:254
#10 0x069210d1 in ?? () from /lib/libnspr4.so
#11 0x0083f51f in start_thread () from /lib/libpthread.so.0
#12 0x0077504e in clone () from /lib/libc.so.6

Thread 1 (Thread 0xb80366d0 (LWP 2085)):
#0  GCGraphBuilder::AddNode (this=0xbf854f78, s=0x1dfcd4c0, 
    aParticipant=0x90bf5dc) at nsCycleCollector.cpp:1287
#1  0x03e1b001 in GCGraphBuilder::AddNode () at nsCycleCollector.cpp:1237
#2  GCGraphBuilder::NoteScriptChild (this=0xbf854f78, langID=2, 
    child=0x1dfcd4c0) at nsCycleCollector.cpp:1458
#3  0x035c73b5 in NoteJSChild (trc=0xbd646000, thing=0x1dfcd4c0, kind=0)
---Type <return> to continue, or q <return> to quit---
    at nsXPConnect.cpp:744
#4  0x00233f2d in JS_CallTracer (trc=0xbf854ed0, thing=0x1dfcd4c0, kind=0)
    at jsgc.c:2449
#5  0x0024a190 in js_TraceObject (trc=0xbf854ed0, obj=0x1dfcd4a0)
    at jsobj.c:5089
#6  0x00233cee in JS_TraceChildren (trc=0xbf854ed0, thing=0x1dfcd4a0, kind=0)
    at jsgc.c:2233
#7  0x035c7474 in nsXPConnect::Traverse (this=0x90bf5c8, p=0x1dfcd4a0, 
    cb=@0xbf854f78) at nsXPConnect.cpp:935
#8  0x03e1a806 in GCGraphBuilder::Traverse (this=0xbf854f78, 
    aPtrInfo=0xbf5fa5dc) at nsCycleCollector.cpp:1319
#9  0x03e1a869 in nsCycleCollector::MarkRoots (this=0x9057750, 
    builder=@0xbf854f78) at nsCycleCollector.cpp:1513
#10 0x03e1b3cb in nsCycleCollector::BeginCollection (this=0x9057750)
    at nsCycleCollector.cpp:2368
#11 0x03e1b424 in nsCycleCollector_beginCollection ()
    at nsCycleCollector.cpp:2910
#12 0x035c8520 in XPCCycleCollectGCCallback (cx=0x94d8330, 
    status=JSGC_MARK_END) at nsXPConnect.cpp:440
#13 0x00234eef in js_GC (cx=0x94d8330, gckind=GC_NORMAL) at jsgc.c:3247
#14 0x002117d8 in JS_GC (cx=0x94d8330) at jsapi.c:2469
#15 0x035c7646 in nsXPConnect::Collect (this=0x90bf5c8) at nsXPConnect.cpp:529
#16 0x03e1b537 in nsCycleCollector::Collect (this=0x9057750, aTryCollections=1)
---Type <return> to continue, or q <return> to quit---
    at nsCycleCollector.cpp:2250
#17 0x03e1b685 in nsCycleCollector_collect () at nsCycleCollector.cpp:2898
#18 0x039d34b0 in nsJSContext::CC () at nsJSEnvironment.cpp:3346
#19 0x039d3768 in nsJSContext::Notify (this=0x19732d30, timer=0x6bd67988)
    at nsJSEnvironment.cpp:3438
#20 0x03e11a1e in nsTimerImpl::Fire (this=0x6bd67988) at nsTimerImpl.cpp:403
#21 0x03e11aa3 in nsTimerEvent::Run (this=0x6189fdc0) at nsTimerImpl.cpp:490
#22 0x03e0ef2c in nsThread::ProcessNextEvent (this=0x9037c88, mayWait=1, 
    result=0xbf8591e4) at nsThread.cpp:510
#23 0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0xbd646000, mayWait=1)
    at nsThreadUtils.cpp:227
#24 0x03d3c488 in nsBaseAppShell::Run (this=0x90dc300)
    at nsBaseAppShell.cpp:170
#25 0x03befe38 in nsAppStartup::Run (this=0x91a7a88) at nsAppStartup.cpp:181
#26 0x035b9de0 in XRE_main (argc=1, argv=0xbf85c8f4, aAppData=0x8fd5258)
    at nsAppRunner.cpp:3193
#27 0x08049169 in main (argc=1, argv=0xbf85c8f4) at nsXULStub.cpp:364
(gdb) quit

The crash looks significant, thanks for the backtrace. However we still need some glue how to reproduce the crash...

Martin,

I understand.  I wish I had a reliable way to reproduce the crash.  The one last night happened while I was sleeping, which means some website in some tab I had open did a refresh and the crash happened during the refresh.  It could be my webmail account.  It could be jdate.  It could be facebook.  It could be some flash program.  It could be one of many many open windows or tabs.

As I said earlier I'm happy to send (privately) my sessionstore if that would help.  I'm also happy to do more debugging on my end if there's something in particular that would help you out.  But honestly I haven't got a "I got to website X and do Y and it crashes".  I wish I did.

Is there some way I can get gdb to print out more information for you?  To give you more context?

Wow, the last two times firefox has "crashed" it hasn't crashed at all, but exited semi-cleanly on its own:

[Thread 0xb7e3fb90 (LWP 4922) exited]
[Thread 0xb52d2b90 (LWP 4939) exited]
[Thread 0xb5cd3b90 (LWP 4940) exited]
[Thread 0xb3ed0b90 (LWP 4942) exited]
[Thread 0xb743eb90 (LWP 4923) exited]

Program exited with code 01.
Missing separate debuginfos, use: debuginfo-install bzip2-libs-1.0.5-3.fc10.i386 libbeagle-0.3.5-1.fc9.i386 libcroco-0.6.1-5.fc9.i386 libgsf-1.14.10-1.fc10.i386 librsvg2-2.22.3-1.fc10.i386 libthai-0.1.9-4.fc9.i386 totem-mozplugin-2.24.3-1.fc10.i386 totem-pl-parser-2.24.3-1.fc10.i386
(gdb) quit


Not sure what could cause this.  I was just trying to file a bug in bugzilla on sendmail.   Maybe firefox thought I'd filed too many bugs already?  ;)

Out of curiosity, do you have nspluginwrapper installed?  If not, does installing it help?

No, I do not have it installed.  I just installed it.  I'll see if that helps any next time firefox restarts (it takes a good 20+ minutes to restart so I'm not just going to restart it now -- I'm sure it will crash/die/exit in the next day or two on its own)  ;-)

... although looking at the description I'm not sure how that will help.  I'm running on x86, not x86_64.   But I'm happy to try.

The description should probably be modified.  What nspluginwrapper does is run plugins in a separate process.  The most common reason people would specifically seek out nspluginwrapper is to be able to execute e.g. 32 bit plugins in a 64 bit browser, so the description is accurate for what people would be looking for.  However, by having a separate process for plugins, if on were to crash (which happens often for many plugins, and we can't fix these crashes if we don't have the source), only it's own process and not the browser's process comes falling down.

(In reply to comment #10)
> ... although looking at the description I'm not sure how that will help.  I'm
> running on x86, not x86_64.   But I'm happy to try.

Besides what Christopher wrote, there is another advantage of plugins being a separate process -- it is more easy to apply SELinux policies on it (think about running random binary goo somewhere from the Web using binary-only runtime from unknown source, which could theoretically gain access to Firefox resources).

Unfortunately, no, nspluginwrapper didn't help.  It might be something related to when the size of the process gets really really huge:

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND            
 5043 warlord   20   0 3012m 2.2g  19m R 99.4 75.4 361:10.82 firefox            

             total       used       free     shared    buffers     cached
Mem:       3105192    3054840      50352          0      52880     146232
-/+ buffers/cache:    2855728     249464
Swap:      5478124    1396244    4081880

Program received signal SIGSEGV, Segmentation fault.
GCGraphBuilder::AddNode (this=0xbfd9f1d4, s=0xab9fc08, aParticipant=0x96d702c)
    at nsCycleCollector.cpp:1287
1287	    if (!e->mNode) {
Current language:  auto; currently c++
(gdb) t a a bt

Thread 536 (Thread 0xbf100b90 (LWP 31385)):
#0  0x003eb416 in __kernel_vsyscall ()
#1  0x00843432 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
#2  0x06919f1e in ?? () from /lib/libnspr4.so
#3  0x0691ad40 in PR_WaitCondVar () from /lib/libnspr4.so
#4  0x0691ae37 in PR_Wait () from /lib/libnspr4.so
#5  0x03e1108b in nsAutoMonitor::Wait ()
    at ../../dist/include/xpcom/nsAutoLock.h:340
#6  nsThreadPool::Run (this=0x9a541f8) at nsThreadPool.cpp:200
#7  0x03e0ef2c in nsThread::ProcessNextEvent (this=0x3be09c40, mayWait=1, 
    result=0xbf100334) at nsThread.cpp:510
#8  0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x80, mayWait=1)
    at nsThreadUtils.cpp:227
#9  0x03e0f7e2 in nsThread::ThreadFunc (arg=0x3be09c40) at nsThread.cpp:254
#10 0x069210d1 in ?? () from /lib/libnspr4.so
#11 0x0083f51f in start_thread () from /lib/libpthread.so.0
#12 0x0077504e in clone () from /lib/libc.so.6

Thread 7 (Thread 0xb7e81b90 (LWP 5044)):
#0  0x003eb416 in __kernel_vsyscall ()
#1  0x0076a777 in poll () from /lib/libc.so.6
---Type <return> to continue, or q <return> to quit---
#2  0x0691cca4 in ?? () from /lib/libnspr4.so
#3  0x0362159b in nsSocketTransportService::Poll (this=0x96c9b20, wait=1, 
    interval=0xb7e811d8) at nsSocketTransportService2.cpp:349
#4  0x03621ab0 in nsSocketTransportService::DoPollIteration (this=0x96c9b20, 
    wait=1) at nsSocketTransportService2.cpp:644
#5  0x03621d6c in nsSocketTransportService::OnProcessNextEvent (
    this=0x96c9b20, thread=0x96ca1b0, mayWait=1, depth=1)
    at nsSocketTransportService2.cpp:523
#6  0x03e0eed0 in nsThread::ProcessNextEvent (this=0x96ca1b0, mayWait=1, 
    result=0xb7e81284) at nsThread.cpp:497
#7  0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x4, mayWait=1)
    at nsThreadUtils.cpp:227
#8  0x036217c7 in nsSocketTransportService::Run (this=0x96c9b20)
    at nsSocketTransportService2.cpp:565
#9  0x03e0ef2c in nsThread::ProcessNextEvent (this=0x96ca1b0, mayWait=1, 
    result=0xb7e81334) at nsThread.cpp:510
#10 0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x4, mayWait=1)
    at nsThreadUtils.cpp:227
#11 0x03e0f7e2 in nsThread::ThreadFunc (arg=0x96ca1b0) at nsThread.cpp:254
#12 0x069210d1 in ?? () from /lib/libnspr4.so
#13 0x0083f51f in start_thread () from /lib/libpthread.so.0
#14 0x0077504e in clone () from /lib/libc.so.6

---Type <return> to continue, or q <return> to quit---
Thread 6 (Thread 0xb7480b90 (LWP 5045)):
#0  0x003eb416 in __kernel_vsyscall ()
#1  0x00843432 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/libpthread.so.0
#2  0x06919f1e in ?? () from /lib/libnspr4.so
#3  0x0691ad40 in PR_WaitCondVar () from /lib/libnspr4.so
#4  0x03e125a0 in TimerThread::Run (this=0x9693110) at TimerThread.cpp:345
#5  0x03e0ef2c in nsThread::ProcessNextEvent (this=0x9847278, mayWait=1, 
    result=0xb7480334) at nsThread.cpp:510
#6  0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x80, mayWait=1)
    at nsThreadUtils.cpp:227
#7  0x03e0f7e2 in nsThread::ThreadFunc (arg=0x9847278) at nsThread.cpp:254
#8  0x069210d1 in ?? () from /lib/libnspr4.so
#9  0x0083f51f in start_thread () from /lib/libpthread.so.0
#10 0x0077504e in clone () from /lib/libc.so.6

Thread 5 (Thread 0xb3f02b90 (LWP 5081)):
#0  0x003eb416 in __kernel_vsyscall ()
#1  0x00843105 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x0691adb7 in PR_WaitCondVar () from /lib/libnspr4.so
#3  0x03c140c3 in nsSSLThread::Run (this=0xb0e4158) at nsSSLThread.cpp:964
#4  0x03c139da in nsPSMBackgroundThread::nsThreadRunner (arg=0xb0e4158)
    at nsPSMBackgroundThread.cpp:44
---Type <return> to continue, or q <return> to quit---
#5  0x069210d1 in ?? () from /lib/libnspr4.so
#6  0x0083f51f in start_thread () from /lib/libpthread.so.0
#7  0x0077504e in clone () from /lib/libc.so.6

Thread 4 (Thread 0xb6a7fb90 (LWP 5082)):
#0  0x003eb416 in __kernel_vsyscall ()
#1  0x00843105 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x0691adb7 in PR_WaitCondVar () from /lib/libnspr4.so
#3  0x03c15231 in nsCertVerificationThread::Run (this=0xb0e4300)
    at nsCertVerificationThread.cpp:138
#4  0x03c139da in nsPSMBackgroundThread::nsThreadRunner (arg=0xb0e4300)
    at nsPSMBackgroundThread.cpp:44
#5  0x069210d1 in ?? () from /lib/libnspr4.so
#6  0x0083f51f in start_thread () from /lib/libpthread.so.0
#7  0x0077504e in clone () from /lib/libc.so.6

Thread 3 (Thread 0xafcc5b90 (LWP 5085)):
#0  0x003eb416 in __kernel_vsyscall ()
#1  0x00843105 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x0691adb7 in PR_WaitCondVar () from /lib/libnspr4.so
#3  0x0691ae37 in PR_Wait () from /lib/libnspr4.so
#4  0x03e0e055 in nsAutoMonitor::Wait ()
    at ../../dist/include/xpcom/nsAutoLock.h:340
---Type <return> to continue, or q <return> to quit---
#5  nsEventQueue::GetEvent (this=0xb5735d8, mayWait=1, result=0xafcc52f4)
    at nsEventQueue.cpp:85
#6  0x03e0ef02 in nsThread::nsChainedEventQueue::GetEvent () at nsThread.h:112
#7  nsThread::ProcessNextEvent (this=0xb5735b8, mayWait=1, result=0xafcc5334)
    at nsThread.cpp:501
#8  0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x80, mayWait=1)
    at nsThreadUtils.cpp:227
#9  0x03e0f7e2 in nsThread::ThreadFunc (arg=0xb5735b8) at nsThread.cpp:254
#10 0x069210d1 in ?? () from /lib/libnspr4.so
#11 0x0083f51f in start_thread () from /lib/libpthread.so.0
#12 0x0077504e in clone () from /lib/libc.so.6

Thread 1 (Thread 0xb80826d0 (LWP 5043)):
#0  GCGraphBuilder::AddNode (this=0xbfd9f1d4, s=0xab9fc08, 
    aParticipant=0x96d702c) at nsCycleCollector.cpp:1287
#1  0x03e1b001 in GCGraphBuilder::AddNode () at nsCycleCollector.cpp:1237
#2  GCGraphBuilder::NoteScriptChild (this=0xbfd9f1d4, langID=2, 
    child=0xab9fc08) at nsCycleCollector.cpp:1458
#3  0x035c73b5 in NoteJSChild (trc=0x5e100000, thing=0xab9fc08, kind=0)
    at nsXPConnect.cpp:744
#4  0x00132f2d in JS_CallTracer (trc=0xbfd9f12c, thing=0xab9fc08, kind=0)
    at jsgc.c:2449
#5  0x0012fe7e in fun_trace (trc=0xbfd9f12c, obj=0x1f604600) at jsfun.c:1399
---Type <return> to continue, or q <return> to quit---
#6  0x0014910c in js_TraceObject (trc=0xbfd9f12c, obj=0x1f604600)
    at jsobj.c:5067
#7  0x00132cee in JS_TraceChildren (trc=0xbfd9f12c, thing=0x1f604600, kind=0)
    at jsgc.c:2233
#8  0x035c7474 in nsXPConnect::Traverse (this=0x96d7018, p=0x1f604600, 
    cb=@0xbfd9f1d4) at nsXPConnect.cpp:935
#9  0x03e1a806 in GCGraphBuilder::Traverse (this=0xbfd9f1d4, 
    aPtrInfo=0x2f7b25c) at nsCycleCollector.cpp:1319
#10 0x03e1a869 in nsCycleCollector::MarkRoots (this=0x96b4770, 
    builder=@0xbfd9f1d4) at nsCycleCollector.cpp:1513
#11 0x03e1b3cb in nsCycleCollector::BeginCollection (this=0x96b4770)
    at nsCycleCollector.cpp:2368
#12 0x03e1b424 in nsCycleCollector_beginCollection ()
    at nsCycleCollector.cpp:2910
#13 0x035c8520 in XPCCycleCollectGCCallback (cx=0x9b34f28, 
    status=JSGC_MARK_END) at nsXPConnect.cpp:440
#14 0x00133eef in js_GC (cx=0x9b34f28, gckind=GC_NORMAL) at jsgc.c:3247
#15 0x001107d8 in JS_GC (cx=0x9b34f28) at jsapi.c:2469
#16 0x035c7646 in nsXPConnect::Collect (this=0x96d7018) at nsXPConnect.cpp:529
#17 0x03e1b537 in nsCycleCollector::Collect (this=0x96b4770, aTryCollections=1)
    at nsCycleCollector.cpp:2250
#18 0x03e1b685 in nsCycleCollector_collect () at nsCycleCollector.cpp:2898
#19 0x039d34b0 in nsJSContext::CC () at nsJSEnvironment.cpp:3346
---Type <return> to continue, or q <return> to quit---
#20 0x039d3580 in nsJSContext::MaybeCC (aHigherProbability=1)
    at nsJSEnvironment.cpp:3397
#21 0x039d35be in nsJSContext::CCIfUserInactive () at nsJSEnvironment.cpp:3414
#22 0x039d3768 in nsJSContext::Notify (this=0xb477558, timer=0xa2e58410)
    at nsJSEnvironment.cpp:3438
#23 0x03e11a1e in nsTimerImpl::Fire (this=0xa2e58410) at nsTimerImpl.cpp:403
#24 0x03e11aa3 in nsTimerEvent::Run (this=0xbe6a1560) at nsTimerImpl.cpp:490
#25 0x03e0ef2c in nsThread::ProcessNextEvent (this=0x9692c88, mayWait=1, 
    result=0xbfda3470) at nsThread.cpp:510
#26 0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x5e100000, mayWait=1)
    at nsThreadUtils.cpp:227
#27 0x03bd8e42 in nsXULWindow::CreateNewContentWindow (this=0xb35fac8, 
    aChromeFlags=1742, aAppShell=0x96ee438, _retval=0xbfda3544)
    at nsXULWindow.cpp:1824
#28 0x03bd706a in nsXULWindow::CreateNewWindow (this=0xb35fac8, 
    aChromeFlags=1578106880, aAppShell=0x96ee438, _retval=0x7ffff)
    at nsXULWindow.cpp:1735
#29 0x03bf002a in nsAppStartup::CreateChromeWindow2 (this=0x98029e8, 

    aParent=0xd5ef0bc, aChromeFlags=1742, aContextFlags=0, aURI=0x76a5c9f8, 
    aCancel=0xbfda36e4, _retval=0xbfda36cc) at nsAppStartup.cpp:450
#30 0x03baeab1 in nsWindowWatcher::OpenWindowJSInternal (this=0x9802b20, 
    aParent=0x212a2160, 
    aUrl=0x76a5c938 "displayimage.php?pid=86861&fullsize=1", 
---Type <return> to continue, or q <return> to quit---
    aName=0xbfda39a0 "17072116524998f01c7fe04", 
    aFeatures=0x76a5c970 "scrollbars=yes,toolbar=no,status=no,resizable=yes,width=773,height=1005", aDialog=0, argv=0x0, aCalledFromJS=1, _retval=0xbfda38d4)
    at nsWindowWatcher.cpp:682
#31 0x03baf0aa in nsWindowWatcher::OpenWindowJS (this=0x9802b20, 
    aParent=0x212a2160, 
    aUrl=0x76a5c938 "displayimage.php?pid=86861&fullsize=1", 
    aName=0xbfda39a0 "17072116524998f01c7fe04", 
    aFeatures=0x76a5c970 "scrollbars=yes,toolbar=no,status=no,resizable=yes,width=773,height=1005", aDialog=0, argv=0x0, _retval=0xbfda38d4)
    at nsWindowWatcher.cpp:484
#32 0x039e8ba1 in nsGlobalWindow::OpenInternal (this=0x212a2160, 
    aUrl=@0xbfda3bc4, aName=@0xbfda3b30, aOptions=@0xbfda3a9c, aDialog=0, 
    aContentModal=0, aCalledNoScript=0, aDoJSFixups=1, argv=0x0, 
    aExtraArgument=0x0, aCalleePrincipal=0x46a9af60, 
    aJSCallerContext=0x427a3900, aReturn=0xbfda3d70) at nsGlobalWindow.cpp:7390
#33 0x039e931e in nsGlobalWindow::Open (this=0x212a2160, _retval=0xbfda3d70)
    at nsGlobalWindow.cpp:5059
#34 0x03e1c1a5 in NS_InvokeByIndex_P () from /usr/lib/xulrunner-1.9/libxul.so
#35 0x035e94d3 in XPCWrappedNative::CallMethod (ccx=@0xbfda3f34, 
    mode=XPCWrappedNative::CALL_METHOD) at xpcwrappednative.cpp:2393
#36 0x035f174a in XPC_WN_CallMethod (cx=0x427a3900, obj=0x3984ab60, argc=3, 
    argv=0x76a483ec, vp=0xbfda4074) at xpcwrappednativejsops.cpp:1473
---Type <return> to continue, or q <return> to quit---
#37 0x00142f90 in js_Invoke (cx=0x427a3900, argc=3, vp=0x76a483e4, flags=2)
    at jsinterp.c:1304
#38 0x0013701c in js_Interpret (cx=0x427a3900) at jsinterp.c:4864
#39 0x00142fdf in js_Invoke (cx=0x427a3900, argc=1, vp=0x76a48354, flags=0)
    at jsinterp.c:1320
#40 0x001432e1 in js_InternalInvoke (cx=0x427a3900, obj=0x373cb220, 
    fval=964993888, flags=0, argc=1, argv=0x76a48350, rval=0xbfda4560)
    at jsinterp.c:1376
#41 0x0010e4c6 in JS_CallFunctionValue (cx=0x427a3900, obj=0x373cb220, 
    fval=964993888, argc=1, argv=0x76a48350, rval=0xbfda4560) at jsapi.c:5054
#42 0x039d5826 in nsJSContext::CallEventHandler (this=0x36ecae40, 
    aTarget=0x4469ee60, aScope=0xe77bcc0, aHandler=0x3984a360, 
    aargv=0x76a5cff0, arv=0xbfda46c0) at nsJSEnvironment.cpp:1962
#43 0x03a0e3aa in nsJSEventListener::HandleEvent (this=0x49c3c6d8, 
    aEvent=0x76a5b688) at nsJSEventListener.cpp:248
#44 0x038d90d7 in nsEventListenerManager::HandleEventSubType (this=0x48f2e428, 
    aListenerStruct=0x48f2e448, aListener=0x49c3c6d8, aDOMEvent=0x76a5b688, 
    aCurrentTarget=0x4469ee60, aPhaseFlags=2)
    at nsEventListenerManager.cpp:1080
#45 0x038d96e1 in nsEventListenerManager::HandleEvent (this=0x48f2e428, 

    aPresContext=0x446e3f60, aEvent=0xbfda4a80, aDOMEvent=0xbfda4944, 
    aCurrentTarget=0x4469ee60, aFlags=2, aEventStatus=0xbfda4948)
    at nsEventListenerManager.cpp:1185
---Type <return> to continue, or q <return> to quit---
#46 0x038f2d55 in nsEventTargetChainItem::HandleEvent (this=0x76a5b8a0, 
    aVisitor=@0xbfda493c, aFlags=2) at nsEventDispatcher.cpp:210
#47 0x038f2ee7 in nsEventTargetChainItem::HandleEventTargetChain (
    this=0x76a5bc80, aVisitor=@0xbfda493c, aFlags=6, aCallback=0xbfda49b0)
    at nsEventDispatcher.cpp:291
#48 0x038f31d4 in nsEventDispatcher::Dispatch (aTarget=0xfc82690, 
    aPresContext=0x446e3f60, aEvent=0xbfda4a80, aDOMEvent=0x0, 
    aEventStatus=0xbfda4da8, aCallback=0xbfda49b0) at nsEventDispatcher.cpp:483

#49 0x0374fe5a in PresShell::HandleEventInternal (this=0x48d108c0, 
    aEvent=0xbfda4a80, aView=0x0, aStatus=0xbfda4da8) at nsPresShell.cpp:5933
#50 0x03750517 in PresShell::HandleEventWithTarget (this=0x48d108c0, 
    aEvent=0xbfda4a80, aFrame=0x465d275c, aContent=0xfc82690, 
    aStatus=0xbfda4da8) at nsPresShell.cpp:5838
#51 0x038dc41d in nsEventStateManager::CheckForAndDispatchClick (
    this=0x3be9f008, aPresContext=0x446e3f60, aEvent=0xbfda4ee8, 
    aStatus=0xbfda4da8) at nsEventStateManager.cpp:3350
#52 0x038e449e in nsEventStateManager::PostHandleEvent (this=0x3be9f008, 
    aPresContext=0x446e3f60, aEvent=0xbfda4ee8, aTargetFrame=0x465d275c, 
    aStatus=0xbfda4da8, aView=0x48f0e820) at nsEventStateManager.cpp:2446
#53 0x0374feaa in PresShell::HandleEventInternal (this=0x48d108c0, 
    aEvent=0xbfda4ee8, aView=0x48f0e820, aStatus=0xbfda4da8)
    at nsPresShell.cpp:5954
#54 0x037505ff in PresShell::HandlePositionedEvent (this=0x48d108c0, 
---Type <return> to continue, or q <return> to quit---
    aView=0x48f0e820, aTargetFrame=0x465d275c, aEvent=0xbfda4ee8, 
    aEventStatus=0xbfda4da8) at nsPresShell.cpp:5821
#55 0x03750a09 in PresShell::HandleEvent (this=0x48d108c0, aView=0x48f0e820, 
    aEvent=0xbfda4ee8, aEventStatus=0xbfda4da8) at nsPresShell.cpp:5681
#56 0x039cbfd6 in nsViewManager::HandleEvent (this=0xcc13fc8, 
    aView=0x48f0e820, aPoint={x = 30510, y = 28470}, aEvent=0xbfda4ee8, 
    aCaptured=0) at nsViewManager.cpp:1382
#57 0x039cde77 in nsViewManager::DispatchEvent (this=0xcc13fc8, 
    aEvent=0xbfda4ee8, aStatus=0xbfda4e90) at nsViewManager.cpp:1337
#58 0x039c8aa0 in HandleEvent (aEvent=0xbfda4ee8) at nsView.cpp:168
#59 0x03d26e88 in nsCommonWidget::DispatchEvent (this=0x4036fcb0, 
    aEvent=0xbfda4ee8, aStatus=@0xbfda4f38) at nsCommonWidget.cpp:158
#60 0x03d1a8a0 in nsWindow::OnButtonReleaseEvent (this=0x4036fcb0, 
    aWidget=0xb17dd38, aEvent=0x2994f420) at nsWindow.cpp:2186
#61 0x03d1f4fd in button_release_event_cb (widget=0xb17dd38, event=0x2994f420)
    at nsWindow.cpp:4669
#62 0x022355e6 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#63 0x00c2e1fb in g_closure_invoke () from /lib/libgobject-2.0.so.0
#64 0x00c44655 in ?? () from /lib/libgobject-2.0.so.0
#65 0x00c45beb in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#66 0x00c461e6 in g_signal_emit () from /lib/libgobject-2.0.so.0
#67 0x0234a98e in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#68 0x0222e0fc in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
---Type <return> to continue, or q <return> to quit---
#69 0x0222f4a7 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#70 0x020472fa in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#71 0x008c0238 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#72 0x008c38e3 in ?? () from /lib/libglib-2.0.so.0
#73 0x008c3aa1 in g_main_context_iteration () from /lib/libglib-2.0.so.0
#74 0x03d25588 in nsAppShell::ProcessNextNativeEvent (this=0x96ee438, 
    mayWait=1) at nsAppShell.cpp:144
#75 0x03d3c1a8 in nsBaseAppShell::DoProcessNextNativeEvent (this=0x96ee438, 
    mayWait=1) at nsBaseAppShell.cpp:151
#76 0x03d3c33f in nsBaseAppShell::OnProcessNextEvent (this=0x96ee438, 
    thr=0x9692c88, mayWait=0, recursionDepth=0) at nsBaseAppShell.cpp:296
#77 0x03e0eed0 in nsThread::ProcessNextEvent (this=0x9692c88, mayWait=1, 
    result=0xbfda5514) at nsThread.cpp:497
#78 0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x5e100000, mayWait=1)
    at nsThreadUtils.cpp:227
#79 0x03d3c488 in nsBaseAppShell::Run (this=0x96ee438)
    at nsBaseAppShell.cpp:170
#80 0x03befe38 in nsAppStartup::Run (this=0x98029e8) at nsAppStartup.cpp:181
#81 0x035b9de0 in XRE_main (argc=1, argv=0xbfda8c24, aAppData=0x9630258)
    at nsAppRunner.cpp:3193
#82 0x08049169 in main (argc=1, argv=0xbfda8c24) at nsXULStub.cpp:364
(gdb) quit
The program is running.  Quit anyway (and detach it)? (y or n) y
LND: Sending signal 11 to Thread 0xb80826d0 (LWP 5043)
Detaching from program: /usr/lib/firefox-3.0.6/firefox, process 5043

I just upgraded to current F10 updates and now it's crashing differently:

Program received signal SIGSEGV, Segmentation fault.
JS_DHashTableOperate (table=0x8be58955, key=0x152b5460, op=JS_DHASH_LOOKUP)
    at jsdhash.c:581
581	    keyHash = table->ops->hashKey(table, key);
Current language:  auto; currently c
Missing separate debuginfos, use: debuginfo-install libthai-0.1.9-4.fc9.i386
(gdb) bt
#0  JS_DHashTableOperate (table=0x8be58955, key=0x152b5460, op=JS_DHASH_LOOKUP)
    at jsdhash.c:581
#1  0x035eac10 in WrappedNative2WrapperMap::Find () at xpcmaps.h:721
#2  XPCWrappedNative::TraceOtherWrapper (this=0x15dc1500, trc=0xbfaa1540)
    at xpcwrappednative.cpp:845
#3  0x035f19b1 in XPCWrappedNative::TraceJS () at xpcprivate.h:2283
#4  xpc_TraceForValidWrapper (trc=0xbfaa1540, wrapper=0x15dc1500)
    at xpcwrappednativejsops.cpp:693
#5  0x002cc10c in js_TraceObject (trc=0xbfaa1540, obj=0x152b5460)
    at jsobj.c:5067
#6  0x002b5cee in JS_TraceChildren (trc=0xbfaa1540, thing=0x152b5460, kind=0)
    at jsgc.c:2233
#7  0x035c7474 in nsXPConnect::Traverse (this=0x83343d8, p=0x152b5460, 
    cb=@0xbfaa15e8) at nsXPConnect.cpp:935
#8  0x03e1a806 in GCGraphBuilder::Traverse (this=0xbfaa15e8, 
    aPtrInfo=0xac52ab0c) at nsCycleCollector.cpp:1319
#9  0x03e1a869 in nsCycleCollector::MarkRoots (this=0x82d40a8, 
    builder=@0xbfaa15e8) at nsCycleCollector.cpp:1513
#10 0x03e1b3cb in nsCycleCollector::BeginCollection (this=0x82d40a8)
    at nsCycleCollector.cpp:2368
#11 0x03e1b424 in nsCycleCollector_beginCollection ()
    at nsCycleCollector.cpp:2910
#12 0x035c8520 in XPCCycleCollectGCCallback (cx=0x89e9078, 
---Type <return> to continue, or q <return> to quit---
    status=JSGC_MARK_END) at nsXPConnect.cpp:440
#13 0x002b6eef in js_GC (cx=0x89e9078, gckind=GC_NORMAL) at jsgc.c:3247
#14 0x002937d8 in JS_GC (cx=0x89e9078) at jsapi.c:2469
#15 0x035c7646 in nsXPConnect::Collect (this=0x83343d8) at nsXPConnect.cpp:529
#16 0x03e1b537 in nsCycleCollector::Collect (this=0x82d40a8, aTryCollections=1)
    at nsCycleCollector.cpp:2250
#17 0x03e1b685 in nsCycleCollector_collect () at nsCycleCollector.cpp:2898
#18 0x039d34b0 in nsJSContext::CC () at nsJSEnvironment.cpp:3346
#19 0x039d3580 in nsJSContext::MaybeCC (aHigherProbability=1)
    at nsJSEnvironment.cpp:3397
#20 0x039d35be in nsJSContext::CCIfUserInactive () at nsJSEnvironment.cpp:3414
#21 0x039d3768 in nsJSContext::Notify (this=0xbd37580, timer=0x24275f48)
    at nsJSEnvironment.cpp:3438
#22 0x03e11a1e in nsTimerImpl::Fire (this=0x24275f48) at nsTimerImpl.cpp:403
#23 0x03e11aa3 in nsTimerEvent::Run (this=0xaf69ed58) at nsTimerImpl.cpp:490
#24 0x03e0ef2c in nsThread::ProcessNextEvent (this=0x82ab948, mayWait=1, 
    result=0xbfaa5884) at nsThread.cpp:510
#25 0x03ddbcf4 in NS_ProcessNextEvent_P (thread=0x0, mayWait=1)
    at nsThreadUtils.cpp:227
#26 0x03d3c488 in nsBaseAppShell::Run (this=0x8890980)
    at nsBaseAppShell.cpp:170
#27 0x03befe38 in nsAppStartup::Run (this=0x88bcae8) at nsAppStartup.cpp:181
#28 0x035b9de0 in XRE_main (argc=1, argv=0xbfaa8f94, aAppData=0x8250258)
---Type <return> to continue, or q <return> to quit---
    at nsAppRunner.cpp:3193
#29 0x08049169 in main (argc=1, argv=0xbfaa8f94) at nsXULStub.cpp:364
(gdb) quit
The program is running.  Quit anyway (and detach it)? (y or n) y

Per discussion on IRC reassigning to cairo.

This message is a reminder that Fedora 10 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 10.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '10'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 10's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 10 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Fedora 10 changed to end-of-life (EOL) status on 2009-12-17. Fedora 10 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.