Crash report: https://crash-stats.mozilla.org/report/index/cc03ecc8-46a2-4e62-8036-c86dd0210413

Reason: EXC_BAD_ACCESS / EXC_I386_GPFLT

Top 10 frames of crashing thread:

0 XUL nsSHistory::InitiateLoad docshell/shistory/nsSHistory.cpp:2184
1 XUL nsSHistory::LoadDifferingEntries docshell/shistory/nsSHistory.cpp:2087
2 XUL nsSHistory::LoadEntry docshell/shistory/nsSHistory.cpp:2064
3 XUL nsSHistory::GotoIndex docshell/shistory/nsSHistory.cpp:1941
4 XUL mozilla::dom::ChildSHistory::GotoIndex docshell/shistory/ChildSHistory.cpp:207
5 XUL nsDocShell::GoBack docshell/base/nsDocShell.cpp:3444
6 XUL NS_InvokeByIndex 
7 XUL XPCWrappedNative::CallMethod js/xpconnect/src/XPCWrappedNative.cpp:1142
8 XUL XPC_WN_CallMethod js/xpconnect/src/XPCWrappedNativeJSOps.cpp:925
9 XUL js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:520

Platforms affected

• macOS 11.2.3
• Windows 10
• Ubuntu 20.04

Steps to Reproduce

1. Launch Firefox
2. Access Preferences and change between the list on the left side of the page
3. Click on refresh page, home, back, forward and keep doing so until the back and forward buttons doesn't do anything anymore.
4. Persisting on the back/forward buttons will result in this crash.

Notes

• The issue can be seen in the following attachment
• Stumbled upon this issue while testing the new toolbar icons, happens on 88.0b9 too.
• Feel free to change the component to the right one if this isn't the correct one.

I can reproduce if Fission is disabled.

STR:

1. Make sure Fission is disabled.
2. Open New tab or any web page
3. Paste and go about:preferences#general
4. Long press click on Back button (session history does not popups, see Bug 1718766)
5. If navigation backed, Long press click Forward button
6. If not crash, Repeat step.4 (The crash should happen within 2-5 times.)

Regression window
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=73339fe01d1bbfbaba90dfb79972da63e56f8391&tochange=c840a269bd87e8f247936de20d40c26d9b30a715

No luck reproducing.

But I think I found the issue, or at least one issue.

given that this is a regression from bug 1670808, does this still happen?

I don't see any crash. The only issue I see is that sometimes if you click on a bunch of different preference panes then navigate back and forward in history, it loses the lastmost item, but I don't see that outside of the preferences page, so seems like a minor issue.

Hi reporter,
Comment 1 suggested this happened with Fission disabled. Since we enable Fission by default in Fx97, is this still reproducible? thanks.

Hey, seems like the issue is not reproducible anymore. Tried with 97.0b6.

I can still reproduce the crash in Firefox91.7.1esr wndows10.

bp-59492c90-ea2d-4b0a-95bf-d9db60220326