This is using a self-build from the 19th. Steps that caused problem: 1. Open the History sidebar 2. Open the Search sidebar 3. Load a new page 189: rv = iter->mMatch->mResult->GetResource(getter_AddRefs(findres)); This expression is too complex for me to evaluate by hand but the address in question is 0xd8d8d8d8 (freed fixed size allocation). Stack backtrace: gklayout!nsTreeRows::FindByResource+0xe4 gklayout!nsXULTreeBuilder::HasGeneratedContent+0x107 gklayout!nsContentTestNode::Constrain+0x103 gklayout!TestNode::Constrain+0xb4 gklayout!nsXULTemplateQueryProcessorRDF::Propagate+0x2de gklayout!nsXULTemplateQueryProcessorRDF::OnAssert+0x50 rdf!CompositeDataSourceImpl::OnAssert+0xa8 appcomps!nsGlobalHistory::NotifyAssert+0xf4 appcomps!nsGlobalHistory::NotifyFindAssertions+0x292 appcomps!nsGlobalHistory::AddURI+0xcf6 docshell!nsDocShell::AddToGlobalHistory+0x127 docshell!nsDocShell::OnNewURI+0x5e4 docshell!nsDocShell::OnLoadingSite+0xf4 docshell!nsDocShell::CreateContentViewer+0x1c8 docshell!nsDSURIContentListener::DoContent+0x130 docshell!nsDocumentOpenInfo::TryContentListener+0x2e4 docshell!nsDocumentOpenInfo::DispatchContent+0x57a docshell!nsDocumentOpenInfo::OnStartRequest+0x4b1 necko!nsHttpChannel::CallOnStartRequest+0x292 necko!nsHttpChannel::ProcessNormal+0x20f

Is this the same bug as 330776?

*** This bug has been marked as a duplicate of 330776 ***