It's a new crash signature that first appeared in 11.0a1/20111129. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=854aabf544d4&tochange=bc48009a6bbb Signature nsXULTreeAccessible::TreeViewChanged() UUID 1bcc71cf-d6c9-4f69-ae3c-0b43c2111201 Date Processed 2011-12-01 02:26:13.616831 Uptime 147 Last Crash 15.0 hours before submission Install Age 14.3 hours since version was first installed. Install Time 2011-11-30 20:05:01 Product Firefox Version 11.0a1 Build ID 20111130031011 Release Channel nightly OS Windows NT OS Version 5.1.2600 Service Pack 3 Build Architecture x86 Build Architecture Info GenuineIntel family 6 model 15 stepping 13 Crash Reason EXCEPTION_ACCESS_VIOLATION_READ Crash Address 0x0 User Comments When I click on the PasswordMaker icon in my statusbar (addon bar) Firefox crashes. App Notes AdapterVendorID: 8086, AdapterDeviceID: 2982, AdapterSubsysID: 00000000, AdapterDriverVersion: 18.104.22.16818 D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers+ EMCheckCompatibility False Frame Module Signature [Expand] Source 0 xul.dll nsXULTreeAccessible::TreeViewChanged accessible/src/xul/nsXULTreeAccessible.cpp:659 1 xul.dll nsRootAccessible::ProcessDOMEvent accessible/src/base/nsRootAccessible.cpp:401 2 xul.dll NotificationController::IsUpdatePending accessible/src/base/NotificationController.cpp:193 3 xul.dll NotificationController::HandleNotification<nsRootAccessible,nsIDOMEvent> accessible/src/base/NotificationController.h:179 More reports at: https://crash-stats.mozilla.com/report/list?signature=nsXULTreeAccessible%3A%3ATreeViewChanged%28%29
The only accessibility-related change that landed in this range was Bug 451161, and that was linux-only iirc. Alex, any thoughts?
Created attachment 578278 [details] [diff] [review] patch
Comment on attachment 578278 [details] [diff] [review] patch r=me.
Comment on attachment 578278 [details] [diff] [review] patch regression from bug 701669 landed on Firefox 10, trivial fix
Created attachment 581969 [details] [diff] [review] patch to land on aurora (warning: had to apply by hand)
Is this something QA can verify?
I have verified the crash stats on Socorro and this crash doesn't appear to have reproduced anymore on builds after the fix for this bug was pushed. Please let me know if you want me to verify this bug any other way.