Might not have anything to do with Simon's code, but it crashes trying to draw the caret for the test page. I tried opening other simple HTML files and it didn't crash. nsTextFrame::GetWidth(nsIRenderingContext & {...}, nsTextFrame::TextStyle & {...}, unsigned short * 0x00158000, int 13096087, int * 0x0012eeb8) line 1634 + 3 bytes nsTextFrame::GetPointFromOffset(nsTextFrame * const 0x0b90f798, nsIPresContext * 0x0c0b3f10, nsIRenderingContext * 0x0c10c140, int 26, nsPoint * 0x0012ef38) line 2294 nsCaret::DrawCaretWithContext(nsIRenderingContext * 0x00000000) line 604 nsCaret::DrawCaret() line 654 nsCaret::StartBlinking() line 372 nsCaret::NotifySelectionChanged(nsCaret * const 0x0c0acae4) line 320 nsRangeList::NotifySelectionListeners() line 1802 nsRangeList::EndBatchChanges(nsRangeList * const 0x0c0ad3b0) line 1778 nsDOMSelection::EndBatchChanges(nsDOMSelection * const 0x0c0ad350) line 4394 nsEditor::Do(nsEditor * const 0x0c109310, nsITransaction * 0x0c10cfa0) line 574 nsTextEditRules::ReplaceNewlines(nsIDOMRange * 0x0c109030) line 1398 + 31 bytes nsTextEditRules::Init(nsTextEditRules * const 0x0c109090, nsHTMLEditor * 0x0c109310, unsigned int 0) line 105 + 17 bytes nsHTMLEditRules::Init(nsHTMLEditRules * const 0x0c109090, nsHTMLEditor * 0x0c109310, unsigned int 0) line 89 + 17 bytes nsHTMLEditor::InitRules() line 648 nsHTMLEditor::Init(nsHTMLEditor * const 0x0c109310, nsIDOMDocument * 0x0c0ae144, nsIPresShell * 0x0c0ad420, unsigned int 0) line 419 nsEditorShell::InstantiateEditor(nsEditorShell * const 0x0c0b8970, nsIDOMDocument * 0x0c0ae144, nsIPresShell * 0x0c0ad420) line 587 + 42 bytes nsEditorShell::DoEditorMode(nsEditorShell * const 0x0c0b8970, nsIWebShell * 0x0c061840) line 636 + 33 bytes nsEditorShell::PrepareDocumentForEditing(nsEditorShell * const 0x0c0b8970, nsIURI * 0x0c0cf340) line 312 + 22 bytes nsEditorShell::OnEndDocumentLoad(nsEditorShell * const 0x0c0b8978, nsIDocumentLoader * 0x0c0612b0, nsIChannel * 0x0c0cc6d0, unsigned int 0) line 3873 + 28 bytes nsWebShell::OnEndDocumentLoad(nsWebShell * const 0x0c061850, nsIDocumentLoader * 0x0c0612b0, nsIChannel * 0x0c0cc6d0, unsigned int 0) line 3217

this is the same stack crawl as #26840; dup *** This bug has been marked as a duplicate of 26840 ***

verified in 2/1 build