William - could you take a look when you get a chance? Could it be a duplicate? Thanks!
I thought I had fixed this one. http://hg.mozilla.org/mozilla-central/annotate/94ba78a42305/layout/forms/nsProgressFrame.cpp#l62 needs to use GetComposedDoc(), not GetDocument()
Created attachment 8475307 [details] [diff] [review] random_getcomposeddoc_fixes.diff These should be rather obvious fixes. I'm looking at still some non-obvious ones.
Do you have a recent Try link handy by chance? :)
No. This really shouldn't need one. This is just fixing a class of crasher bugs. (null-pointer crashes)