A critical element in the crash seems to be GetFormControlFrame in nsHTMLInputElement::SetValueInternal returning a non-NULL value when clicking the link described above. In that case, the crash happens. When GetFormControlFrame returns NULL, the window pops up as expected.
A critical element in the crash seems to be GetFormControlFrame in nsHTMLInputElem ent::SetValueIn ternal returning a non-NULL value when clicking the link described above. In that case, the crash happens. When GetFormControlFrame returns NULL, the window pops up as expected.