787822 - crash in nsIFrame::GetFirstChild

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It's #27 top browser crasher in 17.0a2 and #34 in 18.0a1.

It first appeared in 17.0a1/20120807. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c8d94fe7506a&tochange=1bbc0b65dffb
It's likely a regression from bug 779684.

Signature 	nsIFrame::GetFirstChild(mozilla::layout::FrameChildListID) More Reports Search
UUID	76a54ed9-58dd-41f1-9573-6c5082120901
Date Processed	2012-09-01 18:58:38
Uptime	1903
Last Crash	1.9 weeks before submission
Install Age	2.2 hours since version was first installed.
Install Time	2012-09-01 16:54:52
Product	Firefox
Version	18.0a1
Build ID	20120901030528
Release Channel	nightly
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x2a42, AdapterSubsysID: 02121025, AdapterDriverVersion: 6.14.10.5002
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	False
Adapter Vendor ID	0x8086
Adapter Device ID	0x2a42
Total Virtual Memory	2147352576
Available Virtual Memory	1700716544
System Memory Use Percentage	54
Available Page File	3103227904
Available Physical Memory	941666304

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsIFrame::GetFirstChild 	layout/generic/nsIFrame.h:1075
1 	xul.dll 	nsFrameIterator::GetFirstChildInner 	layout/base/nsFrameIterator.cpp:281
2 	xul.dll 	nsFrameIterator::GetFirstChild 	layout/base/nsFrameIterator.cpp:213
3 	xul.dll 	nsFrameIterator::Next 	layout/base/nsFrameIterator.cpp:85
4 	xul.dll 	nsFocusManager::GetSelectionLocation 	dom/base/nsFocusManager.cpp:2283
5 	xul.dll 	nsFocusManager::DetermineElementToMoveFocus 	dom/base/nsFocusManager.cpp:2477
6 	xul.dll 	nsFocusManager::MoveFocus 	dom/base/nsFocusManager.cpp:527
7 	xul.dll 	nsEventStateManager::PostHandleEvent 	content/events/src/nsEventStateManager.cpp:3481
8 	xul.dll 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6477
9 	xul.dll 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6105
10 	xul.dll 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:5735
11 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:772
12 	xul.dll 	nsView::HandleEvent 	view/src/nsView.cpp:1060
13 	xul.dll 	nsWindow::DispatchEvent 	widget/windows/nsWindow.cpp:3567
14 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/windows/nsWindow.cpp:3590
15 	xul.dll 	nsWindow::DispatchKeyEvent 	widget/windows/nsWindow.cpp:3622
16 	xul.dll 	nsWindow::OnChar 	widget/windows/nsWindow.cpp:6782
17 	xul.dll 	nsWindow::OnKeyDown 	widget/windows/nsWindow.cpp:6511
18 	xul.dll 	nsWindow::ProcessKeyDownMessage 	widget/windows/nsWindow.cpp:5638
19 	xul.dll 	nsWindow::ProcessMessage 	widget/windows/nsWindow.cpp:4762
20 	xul.dll 	nsWindow::WindowProcInternal 	widget/windows/nsWindow.cpp:4336
21 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:32
22 	xul.dll 	nsWindow::WindowProc 	widget/windows/nsWindow.cpp:4278
23 	user32.dll 	InternalCallWinProc 	
24 	user32.dll 	UserCallWinProcCheckWow 	
25 	user32.dll 	DispatchMessageWorker 	
26 	user32.dll 	DispatchMessageW 	
27 	xul.dll 	nsAppShell::ProcessNextNativeEvent 	widget/windows/nsAppShell.cpp:322
28 	xul.dll 	nsBaseAppShell::OnProcessNextEvent 	widget/xpwidgets/nsBaseAppShell.cpp:298
29 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:586
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3AGetFirstChild%28mozilla%3A%3Alayout%3A%3AFrameChildListID%29

Comment 1

[Hubert Figuiere [:hub]]

I have been having it on Linux too.

Comment 2

[Scoobidiver (away)]

(In reply to Hub Figuiere [:hub] from comment #1)
> I have been having it on Linux too.
Can you provide the crash ID?

Comment 3

[Hubert Figuiere [:hub]]

No because it is a local build I run into gdb. There is no crash report. Next time it happens, I'll try to remember to get a stack trace.

Comment 4

[Scoobidiver (away)]

It's #27 top browser crasher in 17.0a2 and #43 in 18.0a1.

Comment 5

[Hubert Figuiere [:hub]]

Here is the stack trace I got in gdb using this afternoon mozilla-inbound

#0  nsFrameIterator::GetFirstChildInner (this=0x7fffffffa220, aFrame=0x0) at /home/hub/source/mozilla/src/layout/base/nsFrameIterator.cpp:281
#1  0x00007ffff4924f17 in nsFrameIterator::GetFirstChild (this=this@entry=0x7fffffffa220, aFrame=aFrame@entry=0x0)
    at /home/hub/source/mozilla/src/layout/base/nsFrameIterator.cpp:213
#2  0x00007ffff4925106 in nsFrameIterator::Next (this=0x7fffffffa220) at /home/hub/source/mozilla/src/layout/base/nsFrameIterator.cpp:85
#3  0x00007ffff4c5b39d in nsFocusManager::GetSelectionLocation (this=this@entry=0x7fffeb0ce7b0, aDocument=0x7fffcea8e800, 
    aPresShell=aPresShell@entry=0x7fff5d5f5e60, aStartContent=0x7fffffffa378, aEndContent=0x7fffffffa398)
    at /home/hub/source/mozilla/src/dom/base/nsFocusManager.cpp:2283
#4  0x00007ffff4c5d770 in nsFocusManager::DetermineElementToMoveFocus (this=this@entry=0x7fffeb0ce7b0, aWindow=0x7fffc0b04400, 
    aStartContent=<optimized out>, aType=aType@entry=1, aNoParentTraversal=aNoParentTraversal@entry=false, aNextContent=0x7fffffffa420)
    at /home/hub/source/mozilla/src/dom/base/nsFocusManager.cpp:2477
#5  0x00007ffff4c5f13f in nsFocusManager::MoveFocus (this=this@entry=0x7fffeb0ce7b0, aWindow=<optimized out>, aStartElement=aStartElement@entry=
    0x0, aType=aType@entry=1, aFlags=aFlags@entry=8192, aElement=0x7fffffffa4c0) at /home/hub/source/mozilla/src/dom/base/nsFocusManager.cpp:527
#6  0x00007ffff4b47895 in nsEventStateManager::PostHandleEvent (this=0x7fff36d2dae0, aPresContext=<optimized out>, aEvent=<optimized out>, 
    aTargetFrame=<optimized out>, aStatus=0x7fffffffa8c4) at /home/hub/source/mozilla/src/content/events/src/nsEventStateManager.cpp:3510
#7  0x00007ffff493ee25 in PresShell::HandleEventInternal (this=this@entry=0x7fff5d5f5e60, aEvent=aEvent@entry=0x7fffffffa930, aStatus=aStatus@entry=
    0x7fffffffa8c4) at /home/hub/source/mozilla/src/layout/base/nsPresShell.cpp:6480
#8  0x00007ffff4940070 in PresShell::HandleEvent (this=0x7fff5d5f5e60, aFrame=<optimized out>, aEvent=0x7fffffffa930, 
    aDontRetargetEvents=<optimized out>, aEventStatus=0x7fffffffa8c4) at /home/hub/source/mozilla/src/layout/base/nsPresShell.cpp:6108
#9  0x00007ffff493f26a in PresShell::HandleEvent (this=<optimized out>, aFrame=0x7fffd2ffc530, aEvent=0x7fffffffa930, aDontRetargetEvents=false, 
    aEventStatus=0x7fffffffa8c4) at /home/hub/source/mozilla/src/layout/base/nsPresShell.cpp:5739
#10 0x00007ffff4c49bf4 in nsViewManager::DispatchEvent (this=<optimized out>, aEvent=0x7fffffffa930, aView=<optimized out>, aStatus=0x7fffffffa8c4)
    at /home/hub/source/mozilla/src/view/src/nsViewManager.cpp:772
#11 0x00007ffff4c471d9 in nsView::HandleEvent (this=<optimized out>, aEvent=0x7fffffffa930, aUseAttachedEvents=<optimized out>)
    at /home/hub/source/mozilla/src/view/src/nsView.cpp:1060
#12 0x00007ffff50fc0f5 in nsWindow::DispatchEvent (this=<optimized out>, aEvent=<optimized out>, aStatus=@0x7fffffffa91c: nsEventStatus_eIgnore)
    at /home/hub/source/mozilla/src/widget/gtk2/nsWindow.cpp:460
#13 0x00007ffff5102b8c in nsWindow::OnKeyPressEvent (this=0x7fffe131d600, aWidget=aWidget@entry=0x7fffd8643980 [MozContainer], aEvent=aEvent@entry=
    0x7fff5a990080) at /home/hub/source/mozilla/src/widget/gtk2/nsWindow.cpp:3022
#14 0x00007ffff5102e46 in key_press_event_cb (widget=0x7fffd8643980 [MozContainer], event=0x7fff5a990080)
    at /home/hub/source/mozilla/src/widget/gtk2/nsWindow.cpp:5476
#15 0x0000003ab2d4db4c in ?? () from /lib64/libgtk-x11-2.0.so.0
#16 0x0000003942a0f664 in g_closure_invoke (closure=0x7fffd85c1fd0, return_value=return_value@entry=0x7fffffffacd0, n_param_values=2, 
    param_values=param_values@entry=0x7fffffffad80, invocation_hint=invocation_hint@entry=0x7fffffffad20) at gclosure.c:777
#17 0x0000003942a206d8 in signal_emit_unlocked_R (node=node@entry=0x7ffff7dfb0a0, detail=detail@entry=0, instance=instance@entry=0x7fffd8643980, 
    emission_return=emission_return@entry=0x7fffffffae50, instance_and_params=instance_and_params@entry=0x7fffffffad80) at gsignal.c:3551
#18 0x0000003942a282a7 in g_signal_emit_valist (instance=0x7fffd8643980, signal_id=<optimized out>, detail=0, var_args=var_args@entry=
    0x7fffffffafd8) at gsignal.c:3310
#19 0x0000003942a287c2 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3356
#20 0x0000003ab2e815ae in ?? () from /lib64/libgtk-x11-2.0.so.0
#21 0x0000003ab2e97eab in gtk_window_propagate_key_event () from /lib64/libgtk-x11-2.0.so.0
#22 0x0000003ab2e9ad3b in ?? () from /lib64/libgtk-x11-2.0.so.0
#23 0x0000003ab2d4db4c in ?? () from /lib64/libgtk-x11-2.0.so.0
#24 0x0000003942a0f664 in g_closure_invoke (closure=closure@entry=0x7ffff7dfc560, return_value=return_value@entry=0x7fffffffb2a0, n_param_values=2, 
    param_values=param_values@entry=0x7fffffffb350, invocation_hint=invocation_hint@entry=0x7fffffffb2f0) at gclosure.c:777
#25 0x0000003942a20450 in signal_emit_unlocked_R (node=node@entry=0x7ffff7dfb0a0, detail=detail@entry=0, instance=instance@entry=0x7fffdff99450, 
    emission_return=emission_return@entry=0x7fffffffb420, instance_and_params=instance_and_params@entry=0x7fffffffb350) at gsignal.c:3589
#26 0x0000003942a282a7 in g_signal_emit_valist (instance=0x7fffdff99450, signal_id=<optimized out>, detail=0, var_args=var_args@entry=
    0x7fffffffb5a8) at gsignal.c:3310
#27 0x0000003942a287c2 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3356
#28 0x0000003ab2e815ae in ?? () from /lib64/libgtk-x11-2.0.so.0
#29 0x0000003ab2d4b9e7 in gtk_propagate_event () from /lib64/libgtk-x11-2.0.so.0
#30 0x0000003ab2d4bc7b in gtk_main_do_event () from /lib64/libgtk-x11-2.0.so.0
#31 0x0000003ab3461edc in ?? () from /lib64/libgdk-x11-2.0.so.0
#32 0x0000003941647695 in g_main_dispatch (context=0x7ffff7d279d0) at gmain.c:2539
#33 g_main_context_dispatch (context=context@entry=0x7ffff7d279d0) at gmain.c:3075
#34 0x00000039416479c8 in g_main_context_iterate (context=context@entry=0x7ffff7d279d0, block=block@entry=1, dispatch=dispatch@entry=1, 
    self=<optimized out>) at gmain.c:3146
#35 0x0000003941647a84 in g_main_context_iteration (context=0x7ffff7d279d0, may_block=1) at gmain.c:3207
#36 0x00007ffff5104311 in nsAppShell::ProcessNextNativeEvent (this=<optimized out>, mayWait=<optimized out>)
    at /home/hub/source/mozilla/src/widget/gtk2/nsAppShell.cpp:131
#37 0x00007ffff511ae72 in nsBaseAppShell::DoProcessNextNativeEvent (this=this@entry=0x7fffeb0cd470, mayWait=<optimized out>, 
    recursionDepth=recursionDepth@entry=0) at /home/hub/source/mozilla/src/widget/xpwidgets/nsBaseAppShell.cpp:139
#38 0x00007ffff511af8d in nsBaseAppShell::OnProcessNextEvent (this=0x7fffeb0cd470, thr=0x7ffff7d24ac0, mayWait=<optimized out>, recursionDepth=0)
    at /home/hub/source/mozilla/src/widget/xpwidgets/nsBaseAppShell.cpp:298
#39 0x00007ffff52b7ef2 in nsThread::ProcessNextEvent (this=0x7ffff7d24ac0, mayWait=true, result=0x7fffffffb94f)
    at /home/hub/source/mozilla/src/xpcom/threads/nsThread.cpp:586
#40 0x00007ffff528c039 in NS_ProcessNextEvent_P (thread=<optimized out>, mayWait=true)
    at /home/hub/source/mozilla/src/obj-x86_64-unknown-linux-gnu/xpcom/build/nsThreadUtils.cpp:220
#41 0x00007ffff51c6110 in mozilla::ipc::MessagePump::Run (this=0x7fffecc31280, aDelegate=0x7ffff7dd3e60)
    at /home/hub/source/mozilla/src/ipc/glue/MessagePump.cpp:117
#42 0x00007ffff52d8978 in RunHandler (this=0x7ffff7dd3e60) at /home/hub/source/mozilla/src/ipc/chromium/src/base/message_loop.cc:201
#43 MessageLoop::Run (this=0x7ffff7dd3e60) at /home/hub/source/mozilla/src/ipc/chromium/src/base/message_loop.cc:175
#44 0x00007ffff511a801 in nsBaseAppShell::Run (this=0x7fffeb0cd470) at /home/hub/source/mozilla/src/widget/xpwidgets/nsBaseAppShell.cpp:163
#45 0x00007ffff4fef630 in nsAppStartup::Run (this=0x7fffeb0d3790) at /home/hub/source/mozilla/src/toolkit/components/startup/nsAppStartup.cpp:273
#46 0x00007ffff47b7a23 in XREMain::XRE_mainRun (this=this@entry=0x7fffffffbbb8) at /home/hub/source/mozilla/src/toolkit/xre/nsAppRunner.cpp:3834
#47 0x00007ffff47b7c13 in XREMain::XRE_main (this=this@entry=0x7fffffffbbb8, argc=argc@entry=2, argv=argv@entry=0x7fffffffdf28, 
    aAppData=aAppData@entry=0x613020) at /home/hub/source/mozilla/src/toolkit/xre/nsAppRunner.cpp:3911
#48 0x00007ffff47b7e5e in XRE_main (argc=2, argv=0x7fffffffdf28, aAppData=0x613020, aFlags=<optimized out>)
    at /home/hub/source/mozilla/src/toolkit/xre/nsAppRunner.cpp:3987
#49 0x000000000040230e in do_main (argv=0x7fffffffdf28, argc=2) at /home/hub/source/mozilla/src/browser/app/nsBrowserApp.cpp:174
#50 main (argc=<optimized out>, argv=<optimized out>) at /home/hub/source/mozilla/src/browser/app/nsBrowserApp.cpp:279

Comment 6

[Wayne Mery (:wsmwk)]

I got this in bp-c271b3ab-036a-448f-bf8a-d32d22120914 using nightly 18.0a1 (2012-09-04)

refreshed https://crash-stats.mozilla.com/report/index/c9ad2f33-10e5-44c7-a1bf-6405c2120914 a couple times, which was getting "crash not found"

0	xul.dll	nsIFrame::GetFirstPrincipalChild	layout/generic/nsIFrame.h:1082
1	xul.dll	nsFrameIterator::GetFirstChild	layout/base/nsFrameIterator.cpp:213
2	xul.dll	nsTextFragment::AppendTo	content/base/src/nsTextFragment.h:146
3	xul.dll	nsFrameIterator::Next	layout/base/nsFrameIterator.cpp:85
4	xul.dll	nsFocusManager::GetSelectionLocation	dom/base/nsFocusManager.cpp:2283
5	xul.dll	PopupAllowedForEvent	content/events/src/nsDOMEvent.cpp:893
6	xul.dll	AbortIfOffMainThreadIfCheckFast	xpcom/base/nsCycleCollector.cpp:1142
7	xul.dll	AbortIfOffMainThreadIfCheckFast	xpcom/base/nsCycleCollector.cpp:1142
8	xul.dll	nsDocShell::QueryInterface	docshell/base/nsDocShell.cpp:913

Comment 7

[Lukas Blakk [:lsblakk] use ?needinfo]

David, this is at #20 in the FF 17 topcrashers now. When we merge to Beta we will  collect more data on this but in the meantime maybe you could prepare a backout of bug 779684 so we can try that in Beta and see if crash volume decreases?

Comment 8

[David Zbarsky (:dzbarsky)]

Attachment: Backout

This backs out bug 779684.

Comment 9

[Jesse Ruderman]

In bug 796188 I have a testcase that crashes with the same signature.  It uses caret browsing but I wouldn't be surprised if something similar could happen with contentEditable.

Hub, when you hit this crash, were you navigating in caret browsing, contenteditable, a plain textarea, or doing something else entirely?

Comment 10

[Lukas Blakk [:lsblakk] use ?needinfo]

(In reply to David Zbarsky (:dzbarsky) from comment #8)
> Created attachment 666644 [details] [diff] [review]
> Backout
> 
> This backs out bug 779684.

Thank you - can you test the backout and nominate for Aurora approval so we can get this in before 17 merges to beta on Oct 8th?

Comment 11

[Hubert Figuiere [:hub]]

(In reply to Jesse Ruderman from comment #9)

> Hub, when you hit this crash, were you navigating in caret browsing,
> contenteditable, a plain textarea, or doing something else entirely?

I have no idea how it happened. It was my main browser in which this happened. I do a lot of things in it.

Comment 12

[David Zbarsky (:dzbarsky)]

Comment on attachment 666644 [details] [diff] [review]
Backout

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 779684
User impact if declined: topcrash
Testing completed (on m-c, etc.): Backout fixes the fuzz testcase that Jesse found which crashes with the same stack
Risk to taking this patch (and alternatives if risky): Reverting to previous code, low risk
String or UUID changes made by this patch: None

Comment 13

[David Zbarsky (:dzbarsky)]

Backed out on inbound: https://hg.mozilla.org/integration/mozilla-inbound/rev/21cb609fe669

Comment 14

[David Zbarsky (:dzbarsky)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/3a10e617dfc9
https://hg.mozilla.org/releases/mozilla-beta/rev/10bd7a864ae2

Comment 15

[Scoobidiver (away)]

https://hg.mozilla.org/mozilla-central/rev/21cb609fe669

Comment 16

[u279076]

Since we don't have a reliable testcase, please verify by checking Socorro.

Comment 17

[Wayne Mery (:wsmwk)]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #16)
> Since we don't have a reliable testcase, please verify by checking Socorro.

with Ed's backout of bug 787822 on trunk, wait on the next merge date.

Comment 18

[Ioana (away)]

Considering comment 17, I only verified on Soccoro for Firefox 17.0. There are no crashes with the same stack trace for Fx 17 builds with the fix:

https://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A17.0b4&version=Firefox%3A17.0b3&version=Firefox%3A17.0b2&version=Firefox%3A17.0b1&query_search=signature&query_type=contains&query=nsFrameIterator%3A%3AGetFirstChild&reason_type=contains&date=11%2F05%2F2012%2009%3A15%3A15&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsFrameIterator%3A%3AGetFirstChild

https://crash-stats.mozilla.com/query/query?product=Firefox&version=Firefox%3A17.0b4&version=Firefox%3A17.0b3&version=Firefox%3A17.0b2&version=Firefox%3A17.0b1&range_value=4&range_unit=weeks&date=11%2F05%2F2012+09%3A14%3A55&query_search=signature&query_type=contains&query=nsFrameIterator%3A%3AGetFirstChildInner&reason=&build_id=&process_type=any&hang_type=any&do_query=1

https://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A17.0b4&version=Firefox%3A17.0b3&version=Firefox%3A17.0b2&version=Firefox%3A17.0b1&query_search=signature&query_type=contains&query=nsIFrame%3A%3AGetFirstPrincipalChild%28%29&reason_type=contains&date=11%2F05%2F2012%2009%3A14%3A55&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsIFrame%3A%3AGetFirstPrincipalChild%28%29

https://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A17.0b4&version=Firefox%3A17.0b3&version=Firefox%3A17.0b2&version=Firefox%3A17.0b1&query_search=signature&query_type=contains&query=nsIFrame%3A%3AGetFirstChild%28mozilla%3A%3Alayout%3A%3AFrameChildListID%29&reason_type=contains&date=11%2F05%2F2012%2009%3A16%3A41&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsIFrame%3A%3AGetFirstChild%28mozilla%3A%3Alayout%3A%3AFrameChildListID%29

Comment 19

[u279076]

Thanks Ioana, can you check the same for Firefox 18?

Comment 20

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk) from comment #17)
> (In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #16)
> > Since we don't have a reliable testcase, please verify by checking Socorro.
> 
> with Ed's backout of bug 787822 on trunk, wait on the next merge date.

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #19)
> Thanks Ioana, can you check the same for Firefox 18?

crashes end after 18.0a2 20121016042009

Comment 22

[Ioana (away)]

Only 3 crashes appear in Socorro, and they are all on pre-fix builds:

https://crash-stats.mozilla.com/query/query?product=Firefox&version=Firefox%3A18.0b1&version=Firefox%3A18.0b2&version=Firefox%3A18.0a2&range_value=4&range_unit=weeks&date=11%2F28%2F2012+16%3A04%3A19&query_search=signature&query_type=contains&query=nsFrameIterator%3A%3AGetFirstChild&reason=&build_id=&process_type=any&hang_type=any&do_query=1

https://crash-stats.mozilla.com/query/query?product=Firefox&version=Firefox%3A18.0b1&version=Firefox%3A18.0b2&version=Firefox%3A18.0a2&range_value=4&range_unit=weeks&date=11%2F28%2F2012+16%3A03%3A42&query_search=signature&query_type=contains&query=nsIFrame%3A%3AGetFirstPrincipalChild%28%29&reason=&build_id=&process_type=any&hang_type=any&do_query=1

https://crash-stats.mozilla.com/query/query?product=Firefox&version=Firefox%3A18.0b1&version=Firefox%3A18.0b2&version=Firefox%3A18.0a2&range_value=4&range_unit=weeks&date=11%2F28%2F2012+16%3A07%3A19&query_search=signature&query_type=contains&query=nsFrameIterator%3A%3AGetFirstChildInner&reason=&build_id=&process_type=any&hang_type=any&do_query=1

https://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A18.0b1&version=Firefox%3A18.0b2&version=Firefox%3A18.0a2&query_search=signature&query_type=contains&query=nsIFrame%3A%3AGetFirstChild%28mozilla%3A%3Alayout%3A%3AFrameChildListID%29&reason_type=contains&date=11%2F28%2F2012%2016%3A05%3A59&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsIFrame%3A%3AGetFirstChild%28mozilla%3A%3Alayout%3A%3AFrameChildListID%29