With that stack trace, it first appeared in 18.0a1/20120929 and is #13 top browser crasher in today's build. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=895f66c4eada&tochange=c09a0c022b2e It's likely a regression from bug 539356 part 9e. It might related to or a dupe of bug 795819. Signature nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::s_EnumStub(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*) More Reports Search UUID d1536852-251f-4be3-9000-d7e032121001 Date Processed 2012-10-01 06:48:51 Uptime 915 Last Crash 15.9 minutes before submission Install Age 15.2 minutes since version was first installed. Install Time 2012-10-01 07:33:07 Product Firefox Version 18.0a1 Build ID 20120930030610 Release Channel nightly OS Windows NT OS Version 6.1.7600 Build Architecture x86 Build Architecture Info AuthenticAMD family 16 model 5 stepping 3 Crash Reason EXCEPTION_ACCESS_VIOLATION_EXEC Crash Address 0x1 App Notes AdapterVendorID: 0x1002, AdapterDeviceID: 0x68c1, AdapterSubsysID: 036e1025, AdapterDriverVersion: 8.961.0.0 D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ EMCheckCompatibility True Adapter Vendor ID 0x1002 Adapter Device ID 0x68c1 Total Virtual Memory 4294836224 Available Virtual Memory 3713724416 System Memory Use Percentage 26 Available Page File 6571540480 Available Physical Memory 3145109504 Frame Module Signature Source 0 @0x1 1 xul.dll nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::s_EnumStub obj-firefox/dist/include/nsTHashtable.h:487 2 xul.dll PL_DHashTableEnumerate obj-firefox/xpcom/build/pldhash.cpp:716 3 xul.dll mozilla::`anonymous namespace'::ContainerState::Finish layout/base/FrameLayerBuilder.cpp:2578 4 xul.dll mozilla::FrameLayerBuilder::BuildContainerLayerFor layout/base/FrameLayerBuilder.cpp:2875 5 xul.dll nsDisplayOwnLayer::BuildLayer layout/base/nsDisplayList.cpp:2672 More reports at: https://crash-stats.mozilla.com/report/list?version=Firefox:18.0a1&signature=nsTHashtable%3Cmozilla%3A%3AFrameLayerBuilder%3A%3ADisplayItemDataEntry%3E%3A%3As_EnumStub%28PLDHashTable*%2C+PLDHashEntryHdr*%2C+unsigned+int%2C+void*%29

Tracking it for 18 and assigning to to matt as bug 539356 part 9e is the suspected bug that caused the regression. Please feel free to reassign

URLs showing up: 3 about:blank 2 https://www.facebook.com/ 1 http://boards.4chan.org/vg/res/14949743 1 wyciwyg://2/http://www.flashscore.ro/ 1 https://boards.4chan.org/g/res/27944843 1 http://www.asrekhodro.com/fa/news/85/listView/All/30/index.html 1 http://www.youtube.com/watch?v=tWinlEHoF7I&feature=related 1 https://boards.4chan.org/g/res/27973474 1 http://twitter.github.com/bootstrap/base-css.html 1 http://www.youtube.com/watch?v=zxLD041uzls 1 http://www.facebook.com/ajax/pagelet/generic.php/PhotoViewerInitPagelet?ajaxpipe 1 https://boards.4chan.org/b/res/428137258 1 http://www.facebook.com/groups/mansoura.dentisrty/ 1 http://us.mg5.mail.yahoo.com/ 1 https://www.facebook.com/groups/148782688520639/?ref=ts 1 http://www.facebook.com/groups/M.U.Dentistry.2012.2013/505146079513858/?notif_t= 1 http://boards.4chan.org/g/1 1 http://www.facebook.com/ 1 http://www.facebook.com/ajax/pagelet/generic.php/PhotoViewerInitPagelet?ajaxpipe 1 http://www.facebook.com/ai.php?aed=AQIR-KvSlg9LXDn91yiMU0lp35L9tV5AeCYC1IF3_9XE5 1 https://www.facebook.com/ajax/pagelet/generic.php/PhotoViewerInitPagelet?ajaxpip 1 http://www.desprotetordelinks.com/desproteger/1.2.9/74593.55368.63058.36912.7613

Does this still show up in the 10/4 nightly?

(In reply to Chris Jones [:cjones] [:warhammer] from comment #3) > Does this still show up in the 10/4 nightly? Yes. It's #7 top crasher in today's build.

Thanks, good to know. STR wanted!

(In reply to Chris Jones [:cjones] [:warhammer] from comment #5) > STR wanted! STR are in bug 798244.

This bug was filed from the Socorro interface and is report bp-4c6294b5-b433-488b-8b6e-7d6c22121005 . ============================================================= STR: 1. Load Google DevTools slideshow: http://www.igvita.com/slides/2012/devtools-tips-and-tricks/ 2. Hold down the right arrow or space bar to rapidly advance the slides RESULT: Crash!

I haven't delved into this very deeply but we're crashing on a dead frame pointer in an mFramesWithLayers map. Marking dependent on bug 795674 which will at least change this bug if not fix it.

Is this still happening now that bug 795674 has landed?

(In reply to Matt Woodrow (:mattwoodrow) from comment #10) > Is this still happening now that bug 795674 has landed? There are crashes up to 19.0a1/20121011 and 18.0a2/20121014.

Bug 795674 was uplifted to Aurora.

Verified fixed on FF 18b1 on Win 7, Ubuntu 12.04 and Mac OS X 10.7.5 using the STR in comment 7.