With combined signatures, it's #17 browser crasher in 24.0a1 and first showed up in 24.0a1/20130514. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7130e5134a6e&tochange=81dd97739fa1 It's likely a regression from bug 866431. Signature js::ArrayBufferObject::byteLength() More Reports Search UUID 8920a30e-5aa7-4f3d-8a03-823cc2130518 Date Processed 2013-05-18 13:13:53 Uptime 127 Last Crash 2.5 minutes before submission Install Age 9.1 hours since version was first installed. Install Time 2013-05-18 04:04:22 Product Firefox Version 24.0a1 Build ID 20130517031000 Release Channel nightly OS Windows NT OS Version 6.1.7601 Service Pack 1 Build Architecture x86 Build Architecture Info GenuineIntel family 6 model 37 stepping 5 Crash Reason EXCEPTION_ACCESS_VIOLATION_READ Crash Address 0x4 App Notes AdapterVendorID: 0x8086, AdapterDeviceID: 0x0046, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.15.10.2555 Processor Notes sp-processor02_phx1_mozilla_com_11074:2012 EMCheckCompatibility True Adapter Vendor ID 0x8086 Adapter Device ID 0x0046 Total Virtual Memory 4294836224 Available Virtual Memory 3839758336 System Memory Use Percentage 27 Available Page File 13964161024 Available Physical Memory 5943611392 Frame Module Signature Source 0 mozjs.dll js::ArrayBufferObject::byteLength js/src/jstypedarrayinlines.h:42 1 mozjs.dll js::ArrayBufferObject::byteLengthGetter js/src/jstypedarray.cpp:133 2 mozjs.dll js::Invoke js/src/jsinterp.cpp:455 3 mozjs.dll js::ArrayBufferObject::obj_getGeneric js/src/jstypedarray.cpp:954 4 mozjs.dll JSObject::getGeneric js/src/jsobjinlines.h:161 5 mozjs.dll js::GetPropertyOperation js/src/jsinterpinlines.h:290 6 mozjs.dll js::Interpret js/src/jsinterp.cpp:2170 7 mozjs.dll js::RunScript js/src/jsinterp.cpp:365 8 mozjs.dll js::Invoke js/src/jsinterp.cpp:455 9 mozjs.dll JS_CallFunctionValue js/src/jsapi.cpp:5848 10 xul.dll mozilla::dom::EventHandlerNonNull::Call obj-firefox/dom/bindings/EventHandlerBinding.cpp:48 More reports at: https://crash-stats.mozilla.com/report/list?signature=js%3A%3AArrayBufferObject%3A%3AbyteLength%28%29 https://crash-stats.mozilla.com/report/list?signature=js%3A%3AArrayBufferObject%3A%3AbyteLengthGetter%28JSContext*%2C+unsigned+int%2C+JS%3A%3AValue*%29

There have been no crashes since 24.0a1/20130525. The working range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=97aa3da59001&tochange=7a2f7a45819a

In that range the most plausible-looking cause is the fix for bug 873757, almost certainly.