Currently #19 on the 10.0a1 top crash list with 33 crashes in the past 7 days, all on OSX. It appears to be a safe null-pointer crash. bp-c402bed2-da3d-44d7-8d2b-bd7542111002 gfxContext::NewPath gfx/thebes/gfxContext.cpp:122 PresShell::RenderDocument layout/base/nsPresShell.cpp:4408 nsCanvasRenderingContext2D::DrawWindow content/canvas/src/nsCanvasRenderingContext2D.cpp:3727 nsIDOMCanvasRenderingContext2D_DrawWindow obj-firefox/x86_64/js/src/xpconnect/src/dom_quickstubs.cpp:3672 @0x1256085ce js::mjit::EnterMethodJIT js/src/methodjit/MethodJIT.cpp:884 js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:945 js::RunScript js/src/jsinterp.cpp:582 ...

Perhaps we need another EnsureSurface() check after the FlushLayoutForTree() call on line 3679? http://hg.mozilla.org/mozilla-central/annotate/90575e23ea93/content/canvas/src/nsCanvasRenderingContext2D.cpp#l3727

The Mac crashes appear to all be 10.7. From what I can of the timestamps it is the same user generating the crashes.

This is bug 614772, the OSX 10.7 crashes just had a slightly different signature so it didn't show up in Socorro...