20100828-crashdata.csv shows nsINode::GetFlags() from zalewski's experimental area at http://lcamtuf.coredump.cx/ffoxdie_n.xml?0.0834231942909669 I can confirm the crash but the report is help up on socorro right now. http://crash-stats.mozilla.com/report/pending/8ca8860f-eb4b-4a44-ba6b-896eb2100831 http://crash-stats.mozilla.com/report/index/8ca8860f-eb4b-4a44-ba6b-896eb2100831 maybe one of many reproducible cases we need for Bug 563984 security sensitive until we get a better look at the stack, and learn more about how the test content was generated.

<chofmann> 3 MBs of <x><x><x><x><x>