After resetting my preferences on my nightly build, typing anything in the URL bar cause a crash due to MOZ_ASSERT(mFrecencyStatsSum >= uOld); * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0) * frame #0: 0x00000001095024ce XUL`nsNavHistory::UpdateFrecencyStats(this=&0x13974d7a0, aPlaceId=4534, aOldFrecency=12168, aNewFrecency=16740) at nsNavHistory.cpp:660 frame #1: 0x000000010956959e XUL`decltype(o=&0x13974d7a0, m=20 23 50 09 01 00 00 00 00 00 00 00 00 00 00 00, args=0x00000002fde2f370, (null)=None).*fp0(Get<0ul, 1ul, 2ul>(fp1).PassAsParameter())) mozilla::detail::RunnableMethodArguments<long long, int, int>::applyImpl<nsNavHistory, void (nsNavHistory::*)(long long, int, int), StoreCopyPassByConstLRef<long long>, StoreCopyPassByConstLRef<int>, StoreCopyPassByConstLRef<int>, 0ul, 1ul, 2ul>(nsNavHistory*, void (nsNavHistory::*)(long long, int, int), mozilla::Tuple<StoreCopyPassByConstLRef<long long>, StoreCopyPassByConstLRef<int>, StoreCopyPassByConstLRef<int> >&, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul>) at nsThreadUtils.h:1165 frame #2: 0x00000001095694bd XUL`_ZN7mozilla6detail23RunnableMethodArgumentsIJxiiEE5applyI12nsNavHistoryMS4_FvxiiEEEDTcl9applyImplfp_fp0_dtdefpT10mArgumentstlNSt3__116integer_sequenceImJLm0ELm1ELm2EEEEEEEPT_T0_(this=&0x2fde2f370, o=&0x13974d7a0, m=20 23 50 09 01 00 00 00 00 00 00 00 00 00 00 00) at nsThreadUtils.h:1171 frame #3: 0x00000001095691ee XUL`mozilla::detail::RunnableMethodImpl<nsNavHistory*, void (nsNavHistory::*)(long long, int, int), true, (mozilla::RunnableKind)0, long long, int, int>::Run(this=&0x2fde2f330) at nsThreadUtils.h:1216 frame #4: 0x000000010167ca4d XUL`nsThread::ProcessNextEvent(this=&0x100512f30, aMayWait=false, aResult=&0x7ffeefbfc843) at nsThread.cpp:1090 frame #5: 0x000000010169e43c XUL`NS_ProcessPendingEvents(aThread=&0x100512f30, aTimeout=10) at nsThreadUtils.cpp:461 frame #6: 0x000000010681588e XUL`nsBaseAppShell::NativeEventCallback(this=&0x1005abca0) at nsBaseAppShell.cpp:98 frame #7: 0x00000001068c2661 XUL`nsAppShell::ProcessGeckoEvents(aInfo=&0x1005abca0) at nsAppShell.mm:436 frame #8: 0x00007fff3567aa61 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 frame #9: 0x00007fff3573447c CoreFoundation`__CFRunLoopDoSource0 + 108 frame #10: 0x00007fff3565d4c0 CoreFoundation`__CFRunLoopDoSources0 + 208 frame #11: 0x00007fff3565c93d CoreFoundation`__CFRunLoopRun + 1293 frame #12: 0x00007fff3565c1a3 CoreFoundation`CFRunLoopRunSpecific + 483 frame #13: 0x00007fff34944d96 HIToolbox`RunCurrentEventLoopInMode + 286 frame #14: 0x00007fff34944b06 HIToolbox`ReceiveNextEventCommon + 613 frame #15: 0x00007fff34944884 HIToolbox`_BlockUntilNextEventMatchingListInModeWithFilter + 64 frame #16: 0x00007fff32bf7a73 AppKit`_DPSNextEvent + 2085 frame #17: 0x00007fff3338de34 AppKit`-[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 3044 frame #18: 0x00000001068c1044 XUL`::-[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:](self=0x00000001005c71f0, _cmd=0x00007fff33887b3d, mask=18446744073709551615, expiration=0x422d63c37f00000d, mode=0x00007fff8f775178, flag='\x01') at nsAppShell.mm:158 frame #19: 0x00007fff32bec885 AppKit`-[NSApplication run] + 764 frame #20: 0x00000001068c3287 XUL`nsAppShell::Run(this=&0x1005abca0) at nsAppShell.mm:715 frame #21: 0x00000001096b9b7b XUL`nsAppStartup::Run(this=&0x120b244c0) at nsAppStartup.cpp:290 frame #22: 0x00000001098621ac XUL`XREMain::XRE_mainRun(this=&0x7ffeefbfeb48) at nsAppRunner.cpp:4669 frame #23: 0x0000000109863714 XUL`XREMain::XRE_main(this=&0x7ffeefbfeb48, argc=5, argv=&0x7ffeefbff1c0, aConfig=0x00007ffeefbfed08) at nsAppRunner.cpp:4814 frame #24: 0x0000000109863f1c XUL`XRE_main(argc=5, argv=&0x7ffeefbff1c0, aConfig=0x00007ffeefbfed08) at nsAppRunner.cpp:4906 frame #25: 0x0000000109877717 XUL`mozilla::BootstrapImpl::XRE_main(this=&0x100508230, argc=5, argv=&0x7ffeefbff1c0, aConfig=0x00007ffeefbfed08) at Bootstrap.cpp:49 frame #26: 0x0000000100001046 firefox`do_main(argc=5, argv=&0x7ffeefbff1c0, envp=&0x7ffeefbff1f0) at nsBrowserApp.cpp:233 frame #27: 0x0000000100000b3a firefox`main(argc=5, argv=&0x7ffeefbff1c0, envp=&0x7ffeefbff1f0) at nsBrowserApp.cpp:306 frame #28: 0x0000000100000a54 firefox`start + 52

Thanks for filing this. It should be fixed by the approach Marco suggests in bug 1461753.

Should now be fixed, please let us know.

well the assertion doesn't exist anymore, so it is fixed.

Sorry, I didn't verify the fix was good, at the time I had manually edited the preference so that it wouldn't assert.

As discussed, no qe-verify needed

Marking fixed in 62 from comment 4.