It is a new crash signature that first appeared in 4.0b12pre/20110210, except two occurrences in 4.0b10. It is #5 top crasher on Mac OS X in 4.0b12pre over the last week. Signature gfxTextRun::FetchGlyphExtents UUID 6cdda644-4f3f-48e0-a3eb-6e4f32110210 Time 2011-02-10 22:28:40.62157 Uptime 121 Last Crash 123 seconds before submission Install Age 2657 seconds (44.3 minutes) since version was first installed. Product Firefox Version 4.0b12pre Build ID 20110210030400 Branch 2.0 OS Mac OS X OS Version 10.6.6 10J567 CPU amd64 CPU Info family 6 model 23 stepping 6 Crash Reason EXC_BAD_ACCESS / KERN_INVALID_ADDRESS Crash Address 0x1ce216f4 App Notes Renderers: 0x22600,0x20400 Frame Module Signature [Expand] Source 0 XUL gfxTextRun::FetchGlyphExtents gfx/thebes/gfxFont.cpp:4218 1 XUL gfxFontGroup::MakeTextRun gfx/thebes/gfxFont.cpp:2385 2 XUL TextRunWordCache::MakeTextRun gfx/thebes/gfxTextRunWordCache.cpp:722 3 XUL BuildTextRunsScanner::BuildTextRunForFrames layout/generic/nsTextFrameThebes.cpp:508 4 XUL BuildTextRunsScanner::FlushFrames layout/generic/nsTextFrameThebes.cpp:1304 5 XUL BuildTextRunsScanner::ScanFrame layout/generic/nsTextFrameThebes.cpp:1461 6 XUL nsTextFrame::EnsureTextRun layout/generic/nsTextFrameThebes.cpp:1210 7 XUL nsTextFrame::AddInlineMinWidthForFlow layout/generic/nsTextFrameThebes.cpp:5991 8 XUL nsTextFrame::AddInlineMinWidth layout/generic/nsTextFrameThebes.cpp:6103 9 XUL nsBlockFrame::GetMinWidth layout/generic/nsBlockFrame.cpp:762 10 XUL nsLayoutUtils::IntrinsicForContainer layout/base/nsLayoutUtils.cpp:2136 11 XUL GetWidthInfo layout/tables/BasicTableLayoutStrategy.cpp:113 12 XUL BasicTableLayoutStrategy::ComputeColumnIntrinsicWidths layout/tables/BasicTableLayoutStrategy.cpp:238 13 XUL BasicTableLayoutStrategy::ComputeIntrinsicWidths layout/tables/BasicTableLayoutStrategy.cpp:418 14 XUL BasicTableLayoutStrategy::GetMinWidth layout/tables/BasicTableLayoutStrategy.cpp:72 15 XUL nsTableFrame::ComputeAutoSize layout/tables/nsTableFrame.cpp:1556 16 XUL nsFrame::ComputeSize layout/generic/nsFrame.cpp:3358 17 XUL nsTableFrame::ComputeSize layout/tables/nsTableFrame.cpp:1541 18 XUL nsTableOuterFrame::ComputeAutoSize layout/tables/nsTableOuterFrame.cpp:583 19 XUL nsFrame::ComputeSize layout/generic/nsFrame.cpp:3358 20 XUL nsBlockFrame::WidthToClearPastFloats layout/generic/nsBlockFrame.cpp:7094 21 XUL nsBlockReflowState::ComputeBlockAvailSpace layout/generic/nsBlockReflowState.cpp:293 22 XUL nsBlockFrame::ReflowBlockFrame layout/generic/nsBlockFrame.cpp:3148 23 XUL nsBlockFrame::ReflowLine layout/generic/nsBlockFrame.cpp:2506 ... More reports at: https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=4&range_unit=weeks&signature=gfxTextRun%3A%3AFetchGlyphExtents

4.0b12pre/20110210, new profile, visit http://forum.mozilla-russia.org/viewtopic.php?id=48154 => crash

This is a regression from the patch in bug 631035.

This was a silly error in the patch for bug 631035, which could lead to out-of-order entries in mOffsetToIndex and hence to failure in the Get() function.

This should clearly block, IMO - it's a regression and crasher, and will probably be common in the wild.

http://hg.mozilla.org/mozilla-central/rev/caffaf707958 (patch) http://hg.mozilla.org/mozilla-central/rev/2e96d820f43f (crashtest)