Created attachment 383790 [details] Testcase (CRASHES on load) Loading the attached testcase crashes Firefox trunk. It doesn't crash 1.9.1 or 1.9.0 builds for me. (all on Linux x86-64)
Created attachment 383804 [details] testcase2 This seems like the same issue, except it seems to have a different regression range and different stacktrace, namely not.
Martijn: are you filing testcase2 as a separate bug then?
Neither testcase crashes Firefox 3.6, Firefox 3.5.7, or a trunk debug build for me (on Linux). dveditz, any reason to keep this one open still?
It appears to have been fixed in the range 2009-10-05-03 -- 2009-10-06-03: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1470fa9c9f01&tochange=8f1ba5c38bb1 Bug 520070 is in that range and the attached crash stack looks similar to the one in that bug. We should land the crashtests in this bug when bug 520070 is made public.
Landed crashtests: http://hg.mozilla.org/mozilla-central/rev/09336169ed68 I think we can make this bug public now.