On current m-c tip, I'm getting a crash with the below stack immediately after Google Maps finishes loading. Odd thing is that I can't reproduce on a new profile. xul.dll!JSObject::removeProperty(JSContext * cx, int id) Line 987 + 0x18 bytes C++ xul.dll!js_DeleteProperty(JSContext * cx, JSObject * obj, int id, js::Value * rval) Line 5300 + 0xd bytes C++ xul.dll!JSObject::deleteProperty(JSContext * cx, int id, js::Value * rval) Line 1035 + 0x1b bytes C++ xul.dll!js::Interpret(JSContext * cx, JSStackFrame * entryFrame, unsigned int inlineCallCount, unsigned int interpFlags) Line 3604 + 0x11 bytes C++ xul.dll!js::RunScript(JSContext * cx, JSScript * script, JSFunction * fun, JSObject * scopeChain) Line 468 + 0x11 bytes C++ xul.dll!js::Invoke(JSContext * cx, const js::CallArgs & argsRef, unsigned int flags) Line 614 + 0x1a bytes C++ xul.dll!js::mjit::stubs::SlowCall(js::VMFrame & f, unsigned long argc) Line 260 + 0x24 bytes C++ xul.dll!CallCompiler::update() Line 642 + 0xe bytes C++ xul.dll!js::mjit::ic::Call(js::VMFrame & f, unsigned long index) Line 690 C++ xul.dll!EnterMethodJIT(JSContext * cx, JSStackFrame * fp, void * code, void * safePoint) Line 760 + 0x29 bytes C++ xul.dll!js::mjit::JaegerShot(JSContext * cx) Line 788 + 0x15 bytes C++ xul.dll!js::Interpret(JSContext * cx, JSStackFrame * entryFrame, unsigned int inlineCallCount, unsigned int interpFlags) Line 4597 + 0x6 bytes C++ xul.dll!js::RunScript(JSContext * cx, JSScript * script, JSFunction * fun, JSObject * scopeChain) Line 468 + 0x11 bytes C++ xul.dll!js::Execute(JSContext * cx, JSObject * chain, JSScript * script, JSStackFrame * down, unsigned int flags, js::Value * result) Line 790 + 0x15 bytes C++ xul.dll!obj_eval(JSContext * cx, unsigned int argc, js::Value * vp) Line 1253 + 0x2d bytes C++ xul.dll!nsDisplayWrapper::WrapListsInPlace(nsDisplayListBuilder * aBuilder, nsIFrame * aFrame, const nsDisplayListSet & aLists) Line 1197 + 0xb bytes C++