This is a strange one. The nsStyleDisplay struct is filled with junk. Here's the stack trace: NTDLL! 77f76148() nsDebug::NotYetImplemented(const char * 0x0067bb8c, const char * 0x0067bb58, int 519) line 140 + 13 bytes nsInlineReflow::CanPlaceFrame(nsHTMLReflowMetrics & {...}, unsigned int & 0) line 519 + 21 bytes nsInlineReflow::ReflowFrame(nsIFrame * 0x00f90ad0, int 1, unsigned int & 0) line 272 + 16 bytes nsBaseIBFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineBox * 0x00f90a10, nsIFrame * 0x00f90ad0, int & 1, int & 1) line 2275 + 31 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x00f90a10, int & 1) line 1634 + 28 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1328 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4867 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x00f90bd4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 803 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x00f90bd4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 4500 + 25 bytes nsAreaFrame::Reflow(nsAreaFrame * const 0x00f90bd4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 323 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x00f90bd0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableCellFrame::Reflow(nsTableCellFrame * const 0x00f90c74, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 428 nsContainerFrame::ReflowChild(nsIFrame * 0x00f90c70, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableRowFrame::InitialReflow(nsTableRowFrame * const 0x00f93d70, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...}, unsigned int & 0, nsTableCellFrame * 0x00000000, int 1) line 794 + 34 bytes nsTableRowFrame::Reflow(nsTableRowFrame * const 0x00f93d74, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1394 + 39 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x00f93d70, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableRowGroupFrame::ReflowMappedChildren(nsTableRowGroupFrame * const 0x00f976c0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowGroupReflowState & {...}, unsigned int & 0, nsTableRowFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1) line 355 + 34 bytes nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x00f976c4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 960 + 39 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x00f976c0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableFrame::ResizeReflowPass1(nsTableFrame * const 0x00f97c70, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0, nsTableRowGroupFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1) line 2517 nsTableFrame::Reflow(nsTableFrame * const 0x00f97c74, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 2375 + 43 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x00f97c70, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x00f97d74, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 931 + 37 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x00f97d70, const nsRect & {x=0 y=0 width=1073741824 height=1073741824}, int 1, unsigned int & 0) line 153 + 39 bytes nsBaseIBFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x00f99b00, int & 1) line 2125 + 41 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x00f99b00, int & 1) line 1592 + 20 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1328 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4867 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x00f88684, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 803 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x00f88684, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 4500 + 25 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x00f88680, const nsRect & {x=0 y=1020 width=1073741824 height=1073741824}, int 0, unsigned int & 0) line 153 + 39 bytes nsBaseIBFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x00fb5830, int & 1) line 2125 + 41 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x00fb5830, int & 1) line 1592 + 20 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1328 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4867 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x00f8b9c4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 803 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x00f8b9c4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 4500 + 25 bytes nsAreaFrame::Reflow(nsAreaFrame * const 0x00f8b9c4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 323 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x00f8b9c0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableCellFrame::Reflow(nsTableCellFrame * const 0x00f8ba64, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 428 nsContainerFrame::ReflowChild(nsIFrame * 0x00f8ba60, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableRowFrame::InitialReflow(nsTableRowFrame * const 0x00f69380, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...}, unsigned int & 0, nsTableCellFrame * 0x00000000, int 1) line 794 + 34 bytes nsTableRowFrame::Reflow(nsTableRowFrame * const 0x00f69384, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1394 + 39 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x00f69380, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableRowGroupFrame::ReflowMappedChildren(nsTableRowGroupFrame * const 0x00f69700, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowGroupReflowState & {...}, unsigned int & 0, nsTableRowFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1) line 355 + 34 bytes nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x00f69704, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 960 + 39 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x00f69700, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableFrame::ResizeReflowPass1(nsTableFrame * const 0x00f69d00, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0, nsTableRowGroupFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1) line 2517 nsTableFrame::Reflow(nsTableFrame * const 0x00f69d04, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 2375 + 43 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x00f69d00, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x00f6b054, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 931 + 37 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x00f6b050, const nsRect & {x=0 y=0 width=10530 height=1073741824}, int 1, unsigned int & 0) line 153 + 39 bytes nsBaseIBFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x01549140, int & 1) line 2125 + 41 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01549140, int & 1) line 1592 + 20 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1328 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4867 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x00f6b214, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 22572964) line 803 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x00f6b214, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 22572964) line 4500 + 25 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x00f6b210, const nsRect & {x=0 y=0 width=10530 height=1073741824}, int 1, unsigned int & 22572964) line 153 + 39 bytes nsBaseIBFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x0154ab20, int & 1) line 2125 + 41 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x0154ab20, int & 1) line 1592 + 20 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1328 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4867 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x01561cc4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 1240436) line 803 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01561cc4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 1240436) line 4500 + 25 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01561cc0, const nsRect & {x=0 y=0 width=10770 height=1073741824}, int 1, unsigned int & 1240436) line 153 + 39 bytes nsBaseIBFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x01561ba0, int & 1) line 2125 + 41 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01561ba0, int & 1) line 1592 + 20 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1328 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4867 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x01562314, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 803 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01562314, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 4500 + 25 bytes nsAreaFrame::Reflow(nsAreaFrame * const 0x01562314, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 323 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x01562310, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsScrollFrame::Reflow(nsScrollFrame * const 0x01564034, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 329 nsContainerFrame::ReflowChild(nsIFrame * 0x01564030, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes RootFrame::Reflow(RootFrame * const 0x01564e24, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 200 nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x0154ae70, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsSize & {width=11010 height=8910}, nsIRenderingContext & {...}) line 165 PresShell::ProcessReflowCommands(PresShell * const 0x01567bd0) line 868 PresShell::ExitReflowLock(PresShell * const 0x01567bd0) line 526 PresShell::ContentAppended(PresShell * const 0x01567bd8, nsIDocument * 0x015a2d70, nsIContent * 0x01564abc, int 1) line 1021 nsDocument::ContentAppended(nsDocument * const 0x015a2d70, nsIContent * 0x01564abc, int 1) line 921 nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x015a2d70, nsIContent * 0x01564abc, int 1) line 537 HTMLContentSink::DidBuildModel(HTMLContentSink * const 0x015a4bb0, int 1) line 1450 CNavDTD::DidBuildModel(CNavDTD * const 0x015678c0, unsigned int 0, int 1, nsIParser * 0x015a60a0) line 517 + 20 bytes nsParser::DidBuildModel(unsigned int 0) line 485 + 48 bytes nsParser::ResumeParse(nsIDTD * 0x00000000) line 677 nsParser::OnStopBinding(nsParser * const 0x015a60a4, nsIURL * 0x015a3d90, unsigned int 0, const unsigned short * 0x00f65820) line 883 + 17 bytes nsDocumentBindInfo::OnStopBinding(nsDocumentBindInfo * const 0x015a0590, nsIURL * 0x015a3d90, unsigned int 0, const unsigned short * 0x00f65820) line 1728 + 30 bytes OnStopBindingProxyEvent::HandleEvent(OnStopBindingProxyEvent * const 0x00f65b00) line 584 + 45 bytes StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x00f65b04) line 464 + 12 bytes PL_HandleEvent(PLEvent * 0x00f65b04) line 395 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00ecffa0) line 357 + 9 bytes _md_EventReceiverProc(HWND__ * 0x000a05f0, unsigned int 49331, unsigned int 0, long 15531936) line 675 + 9 bytes USER32! 77e71250() 00ecffa0()

Setting all current Open/Normal to M4.

it no longer crashes for me

verified worksforme