I am seeing a hard-to-reproduce crash on a number of sites including http://www.jrj.com.cn/ The crash is in EventHandler::passWheelEventToWidget (and presumably other input events) when you use the scroll wheel over certain iframes (seems to depend on timing) because the widget for the RenderWidget is NULL The widget is NULL because the iframe is never initialized properly. The iframe is never initialized properly because the redirect timer was canceled by another iframe that got the same "unique" internal frame name. FrameTree::uniqueChildName uses childCount() to generate a "unique" name for a child frame. However, this value can repeat if frames are removed from the parent.
I have a patch for this.
This is a dup, but I can't find the original right now. You might want to do some searching -- I remember past patches for this issue causing significant regressions.
*** This bug has been marked as a duplicate of 7899 ***