See zipped up testcase, you need to open the file named 'parentframe.htm' to get the crash after 500ms. http://crash-stats.mozilla.com/report/index/a0316875-b31d-44ef-943c-320882100830 0 ntdll.dll ntdll.dll@0x46bf0 1 mozcrt19.dll arena_dalloc obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:4280 2 mozalloc.dll mozalloc.dll@0x106f 3 xul.dll gfxCallbackDrawable::Draw gfx/thebes/gfxDrawable.cpp:180 4 xul.dll CreateSamplingRestrictedDrawable gfx/thebes/gfxUtils.cpp:254 5 xul.dll gfxUtils::DrawPixelSnapped 6 xul.dll nsLayoutUtils::DrawPixelSnapped layout/base/nsLayoutUtils.cpp:3086 7 xul.dll nsSVGIntegrationUtils::DrawPaintServer layout/svg/base/src/nsSVGIntegrationUtils.cpp:551 8 xul.dll ImageRenderer::Draw 9 xul.dll PaintBackgroundLayer layout/base/nsCSSRendering.cpp:2650 10 xul.dll nsCSSRendering::PaintBackgroundWithSC layout/base/nsCSSRendering.cpp:2373 11 xul.dll nsCSSRendering::PaintBackground layout/base/nsCSSRendering.cpp:1552 12 xul.dll nsDisplayCanvasBackground::Paint layout/generic/nsCanvasFrame.cpp:269 13 xul.dll mozilla::FrameLayerBuilder::DrawThebesLayer layout/base/FrameLayerBuilder.cpp:1436 14 xul.dll mozilla::layers::BasicThebesLayer::Paint gfx/layers/basic/BasicLayers.cpp:389 15 xul.dll mozilla::layers::BasicLayerManager::PaintLayer gfx/layers/basic/BasicLayers.cpp:1069 16 xul.dll mozilla::layers::BasicLayerManager::PaintLayer gfx/layers/basic/BasicLayers.cpp:1077 17 xul.dll mozilla::layers::BasicLayerManager::EndTransaction gfx/layers/basic/BasicLayers.cpp:977 18 xul.dll nsDisplayList::PaintForFrame layout/base/nsDisplayList.cpp:410 19 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:1409 20 xul.dll nsSVGForeignObjectFrame::PaintSVG layout/svg/base/src/nsSVGForeignObjectFrame.cpp:262 etc..

This looks like the same issue as bug 592118, which is sec-sensitive.