It is a new crash signature that first appeared in today's build. It is #3 top crasher in this build. Signature nsPluginStreamListenerPeer::SetUpStreamListener UUID 1c2d4e1c-65bd-4345-b708-bc2d42110106 Time 2011-01-06 09:16:15.434394 Uptime 761 Install Age 761 seconds (12.7 minutes) since version was first installed. Product Firefox Version 4.0b9pre Build ID 20110106030349 Branch 2.0 OS Mac OS X OS Version 10.6.6 10J567 CPU amd64 CPU Info family 6 model 15 stepping 6 Crash Reason EXC_BAD_ACCESS / KERN_INVALID_ADDRESS Crash Address 0x38 User Comments App Notes Renderers: 0x24000,0x20400 Processor Notes EMCheckCompatibility False Crashing Thread Frame Module Signature [Expand] Source 0 XUL nsPluginStreamListenerPeer::SetUpStreamListener modules/plugin/base/src/nsNPAPIPluginStreamListener.h:132 1 XUL nsPluginStreamListenerPeer::OnStartRequest modules/plugin/base/src/nsPluginStreamListenerPeer.cpp:626 2 XUL nsObjectLoadingContent::OnStartRequest content/base/src/nsObjectLoadingContent.cpp:738 3 XUL nsHttpChannel::CallOnStartRequest netwerk/protocol/http/nsHttpChannel.cpp:770 4 XUL nsHttpChannel::ContinueProcessNormal netwerk/protocol/http/nsHttpChannel.cpp:1228 5 XUL nsHttpChannel::ProcessNormal netwerk/protocol/http/nsHttpChannel.cpp:1165 6 XUL nsHttpChannel::ProcessResponse netwerk/protocol/http/nsHttpChannel.cpp:1115 7 XUL nsHttpChannel::OnStartRequest netwerk/protocol/http/nsHttpChannel.cpp:3876 8 XUL nsInputStreamPump::OnInputStreamReady netwerk/base/src/nsInputStreamPump.cpp:441 9 XUL nsInputStreamReadyEvent::Run xpcom/io/nsStreamUtils.cpp:112 10 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:633 11 XUL NS_ProcessPendingEvents_P nsThreadUtils.cpp:200 12 XUL nsBaseAppShell::NativeEventCallback widget/src/xpwidgets/nsBaseAppShell.cpp:132 13 XUL nsAppShell::ProcessGeckoEvents widget/src/cocoa/nsAppShell.mm:399 ... The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d2bd42931b03&tochange=c6e65b6259db It could be bug 475991. More reports at: http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsPluginStreamListenerPeer%3A%3ASetUpStreamListener

Back out bug 475991 for now...? Unless you think we can fix this today/tomorrow.

I will back out if I can't fix it today or tomorrow. I think I can get to it today though.

I really botched a section of logic refactoring in "nsPluginStreamListenerPeer::SetUpStreamListener" in my HTTP redirect handling implementation. I don't know what I was thinking :) I removed a null check and then later on in the function switched to using the wrong pointer to an object, one that might not be valid all of the time. The latter problem doesn't have anything to do with this crash but I caught it while looking into this.

pushed to mozilla-central http://hg.mozilla.org/mozilla-central/rev/a92e087e8e2b

there are 3 crashes on 4.0b9pre builds from 2011 01 08 03330 but none later than that, so there might have been a small existing problem, or some how those jan 8 builds didn't pick up the fix.