This is currently the top crash on Windows by a huge margin, with about 8% of all crashes. I'm not sure why nothing is filed yet for it. All near-null crashes. The comments mostly talk about shutdown.

This is happening on Linux too, btw. And the stacks are definitely shutdown: we're trying to run XBL dtors from the pagehide when closing a XULWindow. Do we have anything like a regression range? Do we have any idea which is null here? mBoundElement?

Looking at the "table" tab in crash stats, it looks like this showed up in the Dec 14 build.

When a node is adopted we seem to clear mBoundElement, but not really tear down it properly. // If we're adopting a node that's not in a document, it might still // have a binding applied. Remove the binding from the element now // that it's getting adopted into a new document. // TODO Fully tear down the binding. adoptedNode->AsContent()->SetXBLBinding(nullptr);

But I still think this. http://hg.mozilla.org/mozilla-central/rev/78b36c1db4e3

Yes, that actually had the null check for mBoundElement

Yeah, that would make sense. We used to just skip running script altogether when !mBoundElement. We should consider restoring that.

Hmm, I didn't upload this last night.

Comment on attachment 8348705 [details] [diff] [review] xbl_crash.diff r=me

https://hg.mozilla.org/mozilla-central/rev/d58545aaeab9 Spinning new nightlies as well.

This needs an Aurora nom so bug 944407 can be uplifted.

Comment on attachment 8348705 [details] [diff] [review] xbl_crash.diff [Approval Request Comment] Bug caused by (feature/regressing bug #): bug 944407 User impact if declined: Crashes Testing completed (on m-c, etc.): landed m-c 2013-12-17 The last crashes with this stack are from 20131217030203 nightly Risk to taking this patch (and alternatives if risky): This is just a null pointer check (bringing back the old behavior) String or IDL/UUID changes made by this patch: NA

Marking this verified fixed based on crashstats. There are no crashes with a Firefox 29 build after 2013-12-17 nor with a Firefox 28 build after 2014-01-02.