With that stack trace, it first showed up in 21.0a1/20130128. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f18b12139151&tochange=80fed51ae074 I suspect bug 830192. Signature nsIFrame::SetNextSibling(nsIFrame*) More Reports Search UUID fab014f0-da52-4ccb-9efb-722e62130201 Date Processed 2013-02-01 22:01:22 Uptime 58 Last Crash 1.4 hours before submission Install Age 2.0 hours since version was first installed. Install Time 2013-02-01 19:49:44 Product Firefox Version 21.0a1 Build ID 20130201030927 Release Channel nightly OS Windows NT OS Version 6.1.7601 Service Pack 1 Build Architecture x86 Build Architecture Info GenuineIntel family 6 model 23 stepping 10 Crash Reason EXCEPTION_ACCESS_VIOLATION_READ Crash Address 0x20 App Notes AdapterVendorID: 0x0000, AdapterDeviceID: 0x0000, AdapterSubsysID: 00000000, AdapterDriverVersion: Has dual GPUs. GPU #2: AdapterVendorID2: 0x10de, AdapterDeviceID2: 0x0165, AdapterSubsysID2: 0000000c, AdapterDriverVersion2: 8.17.12.9670D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- Processor Notes sp-processor02.phx1.mozilla.com_9032:2008 EMCheckCompatibility True Adapter Vendor ID 0x0000 Adapter Device ID 0x0000 Total Virtual Memory 4294836224 Available Virtual Memory 1812770816 System Memory Use Percentage 66 Available Page File 11019157504 Available Physical Memory 2830016512 Frame Module Signature Source 0 xul.dll nsIFrame::SetNextSibling layout/generic/nsIFrame.h:1134 1 xul.dll nsPlaceholderFrame::DestroyFrom layout/generic/nsPlaceholderFrame.cpp:148 2 xul.dll nsBlockFrame::DestroyFrom layout/generic/nsBlockFrame.cpp:284 3 xul.dll nsIFrame::Destroy layout/generic/nsIFrame.h:600 4 xul.dll nsPlaceholderFrame::DestroyFrom layout/generic/nsPlaceholderFrame.cpp:148 5 xul.dll nsIFrame::Destroy layout/generic/nsIFrame.h:600 6 xul.dll nsBlockFrame::DoRemoveFrame layout/generic/nsBlockFrame.cpp:5488 7 xul.dll nsBlockFrame::RemoveFrame layout/generic/nsBlockFrame.cpp:5047 8 xul.dll nsCSSFrameConstructor::ContentRemoved layout/base/nsCSSFrameConstructor.cpp:7601 9 xul.dll nsCSSFrameConstructor::RecreateFramesForContent layout/base/nsCSSFrameConstructor.cpp:9416 10 xul.dll nsCSSFrameConstructor::ProcessRestyledFrames layout/base/nsCSSFrameConstructor.cpp:8214 11 xul.dll nsCSSFrameConstructor::RestyleElement layout/base/nsCSSFrameConstructor.cpp:8363 12 xul.dll mozilla::css::RestyleTracker::DoProcessRestyles layout/base/RestyleTracker.cpp:213 13 xul.dll PresShell::FlushPendingNotifications layout/base/nsPresShell.cpp:3870 14 xul.dll PresShell::FlushPendingNotifications layout/base/nsPresShell.cpp:3759 15 xul.dll nsDocument::FlushPendingNotifications content/base/src/nsDocument.cpp:6730 16 xul.dll mozilla::dom::Element::GetPrimaryFrame content/base/src/Element.cpp:1627 17 xul.dll mozilla::dom::Element::GetStyledFrame content/base/src/Element.cpp:487 18 xul.dll nsGenericHTMLElement::GetOffsetRect content/html/content/src/nsGenericHTMLElement.cpp:398 19 xul.dll nsGenericHTMLElement::OffsetTop content/html/content/src/nsGenericHTMLElement.h:276 20 xul.dll mozilla::dom::HTMLElementBinding::get_offsetTop obj-firefox/dom/bindings/HTMLElementBinding.cpp:1266 21 xul.dll mozilla::dom::HTMLElementBinding::genericGetter obj-firefox/dom/bindings/HTMLElementBinding.cpp:5188 22 mozjs.dll js::InvokeKernel js/src/jsinterp.cpp:390 23 mozjs.dll js::Invoke js/src/jsinterp.cpp:437 24 mozjs.dll js::GetPropertyOperation js/src/jsinterpinlines.h:310 ... More reports at: https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3ASetNextSibling%28nsIFrame*%29

I think we're going to need some URLs here.

It has been uplifted to Aurora since 20.0a2/20130131. The Aurora regression range is: http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=2869cb7fdf8e&tochange=a728a1f234a0 It's indeed a regression from bug 830192.

It's #9 top browser crasher in 20.0a2 and #25 in 21.0a1.

ni? on KaiRo for URLs here, to pave the way for QA testing. Also assigning to roc due to suspicion that bug 830192 is the regressing bug.

URLs from 20.0a2 - all others have only 1 hit, and I think this list points in a certain direction anyhow. :) 10 http://auto.mail.ru/article.html?id=40236 7 about:blank 5 http://auto.mail.ru/article.html?id=40246 5 http://auto.mail.ru/article.html?id=40258 4 http://auto.mail.ru/article.html?id=40199 2 http://auto.mail.ru/article.html?id=40286 2 http://auto.mail.ru/catalogue/kia/sportage/ 2 http://auto.mail.ru/article.html?id=40152 2 http://auto.mail.ru/testdrive.html?id=40182 2 http://auto.mail.ru/article.html?id=40233 2 http://auto.mail.ru/catalogue/renault/logan/ 2 http://auto.mail.ru/catalogue/opel/antara/ 2 http://auto.mail.ru/catalogue/toyota/land_cruiser_prado/ 2 http://auto.mail.ru/article.html?id=40228 2 http://bitelia.com/2013/02/security-score-auditoria-seguridad 2 http://auto.mail.ru/catalogue/lada_vaz/kalina/ 2 http://bitelia.com/2013/02/gestion-de-proyectos-google-chrome 2 http://auto.mail.ru/article.html?id=40226

Across all versions, the top URLs for this are: 22 about:blank 15 https://www.bonprix.de/confirmation.htm?pageType=lastCheck&sourcePageClick=bestellen&itemTotalClass=order-amount&lastcheckTest=false&siteArea=checkout 11 http://auto.mail.ru/article.html?id=40236 6 http://auto.mail.ru/article.html?id=40199 5 http://auto.mail.ru/article.html?id=40258 5 http://auto.mail.ru/article.html?id=40246 5 http://edu.uast.ac.ir/f7OfgBZh5Dd2C7qwE58JKACJhOHLtBEYkfruamxvOow-_edu.do

I've tried loading these sites and failed to reproduce the crash. Anyone else want to have a go?

Adding QA to see if they can repro with the urls provided

(In reply to Robert O'Callahan (:roc) (Mozilla Corporation) from comment #7) > I've tried loading these sites and failed to reproduce the crash. Anyone > else want to have a go? roc, BTW, when you are logged into Socorro, you can directly get to the URL list with all of them, even those with 1 hit only, see the URLs tab on https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3ASetNextSibling%28nsIFrame*%29

Crashes stopped after 21.0a1/20130212 and 20.0a2/20130212. The working ranges are: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=36525224b14e&tochange=161a347bda5b http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=10a9b88b6ac7&tochange=184912994f15

There are 4 crashes (2 Fx22a1, 2 Fx20b2) in Socorro for the last 4 weeks, but they don't look like the same bug: https://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A22.0a1&version=Firefox%3A21.0a2&version=Firefox%3A20.0b4&version=Firefox%3A20.0b5&version=Firefox%3A20.0b3&version=Firefox%3A20.0b2&version=Firefox%3A20.0b1&query_search=signature&query_type=contains&query=nsIFrame%3A%3ASetNextSibling%28nsIFrame%2A%29&reason_type=contains&date=03%2F14%2F2013%2009%3A15%3A45&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsIFrame%3A%3ASetNextSibling%28nsIFrame%2A%29