I was able to get this pretty consistently by playing around with the "back" button in Mozilla, but I can't come up with a solidly reproducable recipe. This seemed to cause it once in a while: 1. Run a buglist query 2. Choose a but with an attachment. 2. click on the attachment 3 [details] [diff] [review]. click the back button to return to the bug. 4. click the back button again to return to the buglist. 5. click the back button again to return to the query page. Rinse, repeat. It looks like the crash may be timing related from the stack trace...ugh. RestoreFrameStateFor(nsIPresContext * 0x02a8caf0, nsIFrame * 0x02adb040, nsILayoutHistoryState * 0x02d98710) line 1449 + 21 bytes FrameManager::RestoreFrameState(FrameManager * const 0x02a779d0, nsIPresContext * 0x02a8caf0, nsIFrame * 0x02adb040, nsILayoutHistoryState * 0x02d98710) line 1467 + 17 bytes FrameManager::RestoreFrameState(FrameManager * const 0x02a779d0, nsIPresContext * 0x02a8caf0, nsIFrame * 0x02adb290, nsILayoutHistoryState * 0x02d98710) line 1476 + 24 bytes FrameManager::RestoreFrameState(FrameManager * const 0x02a779d0, nsIPresContext * 0x02a8caf0, nsIFrame * 0x02adb310, nsILayoutHistoryState * 0x02d98710) line 1476 + 24 bytes FrameManager::RestoreFrameState(FrameManager * const 0x02a779d0, nsIPresContext * 0x02a8caf0, nsIFrame * 0x02ad9990, nsILayoutHistoryState * 0x02d98710) line 1476 + 24 bytes FrameManager::RestoreFrameState(FrameManager * const 0x02a779d0, nsIPresContext * 0x02a8caf0, nsIFrame * 0x02adc7f0, nsILayoutHistoryState * 0x02d98710) line 1476 + 24 bytes FrameManager::RestoreFrameState(FrameManager * const 0x02a779d0, nsIPresContext * 0x02a8caf0, nsIFrame * 0x02adcdb0, nsILayoutHistoryState * 0x02d98710) line 1476 + 24 bytes FrameManager::RestoreFrameState(FrameManager * const 0x02a779d0, nsIPresContext * 0x02a8caf0, nsIFrame * 0x02adce40, nsILayoutHistoryState * 0x02d98710) line 1476 + 24 bytes FrameManager::RestoreFrameState(FrameManager * const 0x02a779d0, nsIPresContext * 0x02a8caf0, nsIFrame * 0x02ad95b0, nsILayoutHistoryState * 0x02d98710) line 1476 + 24 bytes FrameManager::RestoreFrameState(FrameManager * const 0x02a779d0, nsIPresContext * 0x02a8caf0, nsIFrame * 0x02aa5910, nsILayoutHistoryState * 0x02d98710) line 1476 + 24 bytes PresShell::ContentAppended(PresShell * const 0x02a77f18, nsIDocument * 0x02a8e690, nsIContent * 0x02a74adc, int 29) line 2099 nsDocument::ContentAppended(nsDocument * const 0x02a8e690, nsIContent * 0x02a74adc, int 29) line 1551 nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x02a8e690, nsIContent * 0x02a74adc, int 29) line 1041 HTMLContentSink::NotifyAppend(nsIContent * 0x02a74adc, int 29) line 3523 SinkContext::FlushTags() line 1751 HTMLContentSink::WillInterrupt(HTMLContentSink * const 0x02a8dc40) line 2090 CNavDTD::WillInterruptParse(CNavDTD * const 0x02a77310) line 3256 + 27 bytes nsParser::ResumeParse(nsIDTD * 0x00000000, int 0) line 989 nsParser::OnDataAvailable(nsParser * const 0x02a8dda4, nsIChannel * 0x02a82260, nsISupports * 0x00000000, nsIInputStream * 0x02a8f5b8, unsigned int 0, unsigned int 3760) line 1310 + 19 bytes nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x02a84b10, nsIChannel * 0x02a82260, nsISupports * 0x00000000, nsIInputStream * 0x02a8f5b8, unsigned int 0, unsigned int 3760) line 1440 + 43 bytes nsChannelListener::OnDataAvailable(nsChannelListener * const 0x02a82340, nsIChannel * 0x02a82260, nsISupports * 0x00000000, nsIInputStream * 0x02a8f5b8, unsigned int 0, unsigned int 3760) line 1589 nsHTTPResponseListener::OnDataAvailable(nsHTTPResponseListener * const 0x02a8f630, nsIChannel * 0x02a74f40, nsISupports * 0x02a82260, nsIInputStream * 0x02a8f5b8, unsigned int 16384, unsigned int 3760) line 207 + 55 bytes nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x02d77050) line 370 nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x02d75b40) line 93 + 12 bytes PL_HandleEvent(PLEvent * 0x02d75b40) line 537 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00c15ed0) line 498 + 9 bytes _md_EventReceiverProc(HWND__ * 0x01a4054a, unsigned int 49290, unsigned int 0, long 12672720) line 972 + 9 bytes USER32! 77e71268() 00c15ed0()

Putting on PDT+ radar.

Setting to M12 since this is a PDT+

*** This bug has been marked as a duplicate of 18798 ***

Agreed. Marking as verified dup of 20355.

Agreed. Marking as verified dup of 18798.