All
crash in Trunk M1BR [@ nsImageListener::FrameChanged]  [@ nsImageFrame::FrameChanged] [@ nsImageBoxListener::OnStopDecode] [@ nsTableCellFrame::SetColIndex] [@ @0x00000000][@ nsImageWin::DrawToImage]  (remaining issues from bug 144315)
Layout