User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1 Firefox/7.0.1 Build ID: 20110928134238 Steps to reproduce: Using the attached sessionstore.js, the browser loads with the New York Times as the active tab. Then attempt to select the Intellicast Milwaukee Weather tab (the leftmost of the three Intellicast tabs). Actual results: Browser freezes. This has been happening regularly (once every day or so) with various tabs and tabgroups since the middle of September, in both the 32- and 64-bit nightlies. Also occurs in safe mode, and in profiles with no extensions and no places.sqllite. Yet, the same sessionstore.js file will function perfectly in 7.0.1. Removing certain tab groups (by guesswork) may eliminate the problem for a day or two, but it always recurs. Expected results: Switch to the selected tab with no freeze.

Regression window(m-c) Works: http://hg.mozilla.org/mozilla-central/rev/c2a23df05c4c Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0a1) Gecko/20110808 Firefox/8.0a1 ID:20110808000159 Hangs http://hg.mozilla.org/mozilla-central/rev/9c7ab0a15292 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0a1) Gecko/20110808 Firefox/8.0a1 ID:20110808052250 Pusglog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c2a23df05c4c&tochange=9c7ab0a15292 Regression window(m-i) Works: http://hg.mozilla.org/integration/mozilla-inbound/rev/b0d6e197c741 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0a1) Gecko/20110806 Firefox/8.0a1 ID:20110806084549 Hangs http://hg.mozilla.org/integration/mozilla-inbound/rev/f7dc94e1b75c Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0a1) Gecko/20110806 Firefox/8.0a1 ID:20110806222139 Pusglog: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=f182f03aaee9&tochange=f7dc94e1b75c Suspected: Bug 646641 - If a document has multiple history entries (either by pushstate or anchor navs) only the last one is hooked into bfcache Maybe duplication of Bug 687710

Probably related to bug 687710.

My loop-detecting script from bug 687710 sees a cycle here: 5542 http://finance.yahoo.com/q?s=%5EDJI --> 5800 http://www.nasa.gov/mission_pages/shuttle/main/index.html --> 5542 http://finance.yahoo.com/q?s=%5EDJI The numbers are document identifiers. Somehow 5542 is a parent of 5800, which is a parent of 5542. That's bizarre. Duping against bug 687710; seems to be the same issue.