Starting in 1/20 builds, a new topcrash appeared (and it's now the #1 crash in trunk builds) at nsCSSFrameConstructor::FindInputData. For reports, see http://crash-stats.mozilla.com/report/list?product=Firefox&branch=1.9.2&version=Firefox%3A3.2a1pre&query_search=signature&query_type=contains&query=&date=&range_value=7&range_unit=days&do_query=1&signature=nsCSSFrameConstructor%3A%3AFindInputData%28nsIContent*%2C%20nsStyleContext*%29
So, the line we're crashing on corresponds perfectly to the crash that was fixed by http://hg.mozilla.org/mozilla-central/rev/9ac7c363cf78 which makes me think that this is in fact also the cause of bug 474915.
In particular, http://hg.mozilla.org/mozilla-central/rev/692ae2bf70de essentially backed out http://hg.mozilla.org/mozilla-central/rev/9ac7c363cf78 (although the previous time I don't know that it was known to show up in crash-stats).
I restored the null-check. http://hg.mozilla.org/mozilla-central/rev/915c70b15d1f
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
I filed bug 475015 to get some URLs for those crashing pages. So far, the only one I found at http://crash-stats.mozilla.com/topcrasher/byurl/Firefox/3.2a1pre is http://www.daemon-search.com/explore and I just loaded it a few dozen times with no crash. :(
Yeah, but I don't have that pageset...
I bet Alice does, though.
Crash Signature: [@ nsCSSFrameConstructor::FindInputData]
Component: Layout: Misc Code → Layout
Product: Core Graveyard → Core
You need to log in before you can comment on or make changes to this bug.