There are currently three crashes in today's build. The regression range is (if applicable for a such low volume): http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d8be4bc4fba8&tochange=712eca11a04e Signature -[ChildView drawRect:inContext:alternate:] More Reports Search UUID 49d55126-0f2c-43e6-9f92-9332f2130117 Date Processed 2013-01-17 19:34:17 Uptime 2 Last Crash more than 3 months before submission Install Age 2 seconds since version was first installed. Install Time 2013-01-17 19:16:20 Product Firefox Version 21.0a1 Build ID 20130117030933 Release Channel nightly OS Mac OS X OS Version 10.8.2 12C60 Build Architecture amd64 Build Architecture Info family 6 model 42 stepping 7 Crash Reason EXC_BAD_ACCESS / KERN_INVALID_ADDRESS Crash Address 0x18 App Notes AdapterVendorID: 0x8086, AdapterDeviceID: 0x 116GL Context? GL Context+ GL Layers? GL Layers+ Processor Notes /data/socorro/stackwalk/bin/exploitable: ERROR: unable to analyze dump EMCheckCompatibility False Adapter Vendor ID 0x8086 Adapter Device ID 0x 116 Frame Module Signature Source 0 XUL -[ChildView drawRect:inContext:alternate:] nsChildView.mm:2524 1 XUL -[ChildView drawRect:inTitlebarContext:] nsChildView.mm:2490 2 XUL nsChildView::WillPaint nsChildView.mm:675 3 XUL nsViewManager::ProcessPendingUpdatesForView nsViewManager.cpp:398 4 XUL nsRefreshDriver::Tick nsRefreshDriver.cpp:955 5 XUL mozilla::RefreshDriverTimer::Tick nsRefreshDriver.cpp:164 6 XUL nsTimerImpl::Fire nsTimerImpl.cpp:482 7 XUL nsTimerEvent::Run nsTimerImpl.cpp:565 8 XUL nsThread::ProcessNextEvent nsThread.cpp:627 9 XUL NS_ProcessPendingEvents_P nsThreadUtils.cpp:188 10 XUL nsBaseAppShell::NativeEventCallback nsBaseAppShell.cpp:97 11 XUL nsAppShell::ProcessGeckoEvents nsAppShell.mm:387 12 CoreFoundation __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ 13 CoreFoundation __CFRunLoopDoSources0 14 CoreFoundation __CFRunLoopRun 15 CoreFoundation CFRunLoopRunSpecific 16 HIToolbox RunCurrentEventLoopInMode 17 HIToolbox ReceiveNextEventCommon 18 HIToolbox BlockUntilNextEventMatchingListInMode 19 AppKit _DPSNextEvent 20 AppKit -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 21 XUL -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] nsAppShell.mm:164 22 AppKit -[NSApplication run] 23 XUL nsAppShell::Run nsAppShell.mm:741 24 XUL nsAppStartup::Run nsAppStartup.cpp:288 25 XUL XREMain::XRE_mainRun nsAppRunner.cpp:3823 26 XUL XREMain::XRE_main nsAppRunner.cpp:3890 27 XUL XRE_main nsAppRunner.cpp:4093 28 firefox main nsBrowserApp.cpp:195 29 firefox start More reports at: https://crash-stats.mozilla.com/report/list?signature=-[ChildView+drawRect%3AinContext%3Aalternate%3A]

*If* this regression range holds up, I'd suspect the patch for bug 829886. But let's wait for a few days before making this bug block that one.

(In reply to Steven Michaud from comment #1) > *If* this regression range holds up Currently hit by 7 users so it holds.

This crashes in code that bug 820839 added, so that seems much more likely to be the cause.

(In reply to comment #3) Oops, missed that one. Yes, it does seem more likely.

It's #2 top browser crasher in Mac OS X over the last 3 days.

I believe this was fixed by bug 831829. However, the most recent crash report was from the 20th nightly and I think this should have been fixed in that build.

The latest crashes happened in 21.0a1/20130120. The working range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=01a8559f5560&tochange=01c964705be7 Bug 831829 is right in it. Note that the cset change between 21.0a1/20130120 and 21.0a1/20130119 is almost empty: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8cc32d6fa707&tochange=01a8559f5560