Since we broke out the js_Interpret crashes by line number, we now have a new topcrash at #47 in the list. Comments don't really give any indication as to how/where this is crashing. Sample stack from bp-f7ff97f7-3dab-42d7-a9c6-988842091213: Frame Module Signature Source 0 js3250.dll js_Interpret js/src/jsinterp.cpp:4436 1 js3250.dll js_Invoke js/src/jsinterp.cpp:1394 2 xul.dll nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*,unsigned short,XPTMethodDescriptor const*,nsXPTCMiniVariant*) js/src/xpconnect/src/xpcwrappedjsclass.cpp:1697 3 xul.dll nsXPCWrappedJS::CallMethod(unsigned short,XPTMethodDescriptor const*,nsXPTCMiniVariant*) js/src/xpconnect/src/xpcwrappedjs.cpp:569 4 xul.dll PrepareAndDispatch xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114 5 xul.dll SharedStub xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141 6 xul.dll nsEventListenerManager::HandleEventSubType(nsListenerStruct*,nsIDOMEventListener*,nsIDOMEvent*,nsPIDOMEventTarget*,unsigned int) content/events/src/nsEventListenerManager.cpp:1098

This is bug 524743. jorendorff is working on backporting the fix to 3.5.

Any time frame for when this fix will be backported to 3.5?

I think bug 526834 is the one that will fix this on 1.9.1, but I'm not sure...