Bug 106737

Happens consistently for me when trying to view:
http://sports.espn.go.com/nba/news/story?id=1634417

for example.

With debuginfo:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1085286080 (LWP 5970)]
0x00b7ca8e in nsWindow::NativeCreate(nsIWidget*, void*, nsRect const&,
nsEventStatus (*)(nsGUIEvent*), nsIDeviceContext*, nsIAppShell*, nsIToolkit*,
nsWidgetInitData*) (this=0x993e670, aParent=0x0, aNativeParent=0x0, aRect=@0x0,
    aHandleEventFunction=0x123ea98 <HandleEvent>, aContext=0x9b427d8,
    aAppShell=0x0, aToolkit=0x0, aInitData=0xb90387) at nsWindow.cpp:2126
2126        g_object_set_data(G_OBJECT(mDrawingarea->clip_window), "nsWindow",
(gdb) print mDrawingarea
$1 = (MozDrawingarea *) 0x0

#0  0x00b7ca8e in nsWindow::NativeCreate(nsIWidget*, void*, nsRect const&,
nsEventStatus (*)(nsGUIEvent*), nsIDeviceContext*, nsIAppShell*, nsIToolkit*,
nsWidgetInitData*) (this=0x993e670, aParent=0x0, aNativeParent=0x0, aRect=@0x0,
    aHandleEventFunction=0x123ea98 <HandleEvent>, aContext=0x9b427d8,
    aAppShell=0x0, aToolkit=0x0, aInitData=0xb90387) at nsWindow.cpp:2126
#1  0x00b794f2 in nsWindow::Create(nsIWidget*, nsRect const&, nsEventStatus
(*)(nsGUIEvent*), nsIDeviceContext*, nsIAppShell*, nsIToolkit*, nsWidgetInitData*)
    (this=0x993e670, aParent=0x0, aRect=@0xbfe89500,
    aHandleEventFunction=0x123ea98 <HandleEvent>, aContext=0x9b427d8,
    aAppShell=0x0, aToolkit=0x0, aInitData=0xbfe894e0) at nsWindow.cpp:289
#2  0x0123ff3b in nsView::CreateWidget(nsID const&, nsWidgetInitData*, void*,
int, int, nsContentType) (this=0x993e608, aWindowIID=@0x12ca8ac,
    aWidgetInitData=0xbfe894e0, aNative=0x0, aEnableDragDrop=1,
    aResetVisibility=0, aContentType=eContentTypeUI) at nsView.cpp:776
#3  0x0107b3bf in DocumentViewerImpl::MakeWindow(nsIWidget*, nsRect const&) (
    this=0x9a02c18, aParentWidget=0x9b8e330, aBounds=@0x130be88)
    at nsDocumentViewer.cpp:1875
#4  0x010792f7 in DocumentViewerImpl::InitInternal(nsIWidget*,
nsIDeviceContext*, nsRect const&, int, int) (this=0x9a02c18,
aParentWidget=0x9b8e330,
    aDeviceContext=0x9b427d8, aBounds=@0xbfe897e0, aDoCreation=1,
    aInPrintPreview=0) at nsDocumentViewer.cpp:845
#5  0x01078c48 in DocumentViewerImpl::Init(nsIWidget*, nsIDeviceContext*, nsRect
const&) (this=0x9a02c18, aParentWidget=0x9b8e330, aDeviceContext=0x9b427d8,
    aBounds=@0xbfe897e0) at nsDocumentViewer.cpp:649
#6  0x00cd0df7 in nsDocShell::SetupNewViewer(nsIContentViewer*) (
    this=0x9a128d0, aNewViewer=0x9a02c18) at nsCOMPtr.h:690
#7  0x00ccf034 in nsDocShell::Embed(nsIContentViewer*, char const*,
nsISupports*) (this=0x9a128d0, aContentViewer=0x9a02c18, aCommand=0xcfe5e2 "",
    aExtraInfo=0x0) at nsDocShell.cpp:4145
#8  0x00ccff9f in nsDocShell::CreateContentViewer(char const*, nsIRequest*,
nsIStreamListener**) (this=0x9a128d0, aContentType=0xbfe89d20 "text/html",
    request=0x9b8d2f0, aContentHandler=0xbfe89b90) at nsCOMPtr.h:684
#9  0x00cdf509 in nsDSURIContentListener::DoContent(char const*, int,
nsIRequest*, nsIStreamListener**, int*) (this=0x9a12a58,
    aContentType=0xbfe89d20 "text/html", aIsContentPreferred=0,
    request=0x9b8d2f0, aContentHandler=0xbfe89b90, aAbortProcess=0x993e670)
    at nsDSURIContentListener.cpp:109
#10 0x00ce2b24 in nsDocumentOpenInfo::DispatchContent(nsIRequest*, nsISupports*)
(this=0x9b8d858, request=0x9b8d2f0, aCtxt=0x0) at nsCOMPtr.h:690
#11 0x00ce268b in nsDocumentOpenInfo::OnStartRequest(nsIRequest*, nsISupports*)
    (this=0x9b8d858, request=0x9b8d2f0, aCtxt=0x0) at nsURILoader.cpp:224
#12 0x00b1c285 in nsHttpChannel::CallOnStartRequest() (this=0x9b8d2f0)
    at nsCOMPtr.h:690
#13 0x00b1c71f in nsHttpChannel::ProcessNormal() (this=0x9b8d2f0)
    at nsHttpChannel.cpp:740
#14 0x00b1c4d5 in nsHttpChannel::ProcessResponse() (this=0x9b8d2f0)
    at nsHttpChannel.cpp:692
#15 0x00b237f7 in nsHttpChannel::OnStartRequest(nsIRequest*, nsISupports*) (
    this=0x9b8d2f0, request=0x9b8eef0, ctxt=0x0) at nsHttpChannel.cpp:3128
#16 0x00aaad4c in nsInputStreamPump::OnStateStart() (this=0x9b8eef0)
    at nsCOMPtr.h:690
#17 0x00aaace7 in nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) (
    this=0x9b8eef0, stream=0x9941b70) at nsInputStreamPump.cpp:318
#18 0x004922b6 in nsInputStreamReadyEvent::EventHandler(PLEvent*) (plevent=0x0)
    at nsCOMPtr.h:690
#19 0x004a6363 in PL_HandleEvent (self=0x9b8d8d4) at plevent.c:659
#20 0x004a627d in PL_ProcessPendingEvents (self=0x8e684f8) at plevent.c:592
#21 0x004a733e in nsEventQueueImpl::ProcessPendingEvents() (this=0x8e6b5a8)
    at nsEventQueue.cpp:387
#22 0x00b80df6 in event_processor_callback (source=0x90541a8,
    condition=G_IO_IN, data=0x993e670) at nsAppShell.cpp:67
#23 0x00a6bccf in g_vsnprintf () from /usr/lib/libglib-2.0.so.0
#24 0x00a4afdd in unblock_source () from /usr/lib/libglib-2.0.so.0
#25 0x00a4bfd8 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#26 0x00a4c2ef in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#27 0x00a4c9cf in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#28 0x0384344f in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#29 0x08ee0f38 in ?? ()
#30 0x08e7e718 in ?? ()
#31 0xbfe8a390 in ?? ()
#32 0xbfe8a318 in ?? ()
#33 0x08ee0f38 in ?? ()

Ooo..interesting.  Looking at this one.

notting found that this is the same as an upstream bug:

http://bugzilla.mozilla.org/show_bug.cgi?id=205492

I've checked in a workaround patch for this.  Should be in -13.