No idea how, but both here and in bug 1426165 we seem to end up with an invalid child or sibling pointer either in [`FragmentOrElement::SaveSubtreeState()`](https://searchfox.org/mozilla-central/rev/2a24205479519e70c0574929f45730d285141584/dom/base/FragmentOrElement.cpp#1091) and in [`FragmentOrElement::DestroyContent()`](https://searchfox.org/mozilla-central/rev/2a24205479519e70c0574929f45730d285141584/dom/base/FragmentOrElement.cpp#1066) while traversing the node tree.
Bug 830679 Comment 11 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
No idea how, but both here and in bug 1426165 we seem to end up with an invalid child or sibling pointer either in [`FragmentOrElement::SaveSubtreeState()`](https://searchfox.org/mozilla-central/rev/2a24205479519e70c0574929f45730d285141584/dom/base/FragmentOrElement.cpp#1091) or in [`FragmentOrElement::DestroyContent()`](https://searchfox.org/mozilla-central/rev/2a24205479519e70c0574929f45730d285141584/dom/base/FragmentOrElement.cpp#1066) while traversing the node tree.