The assertion triggering the crash is "firefox: /build/buildd/cairo-1.10.2/src/cairo-array.c:320: _cairo_array_allocate: Assertion `array->num_elements + num_elements <= array->size' failed."
Lee, any idea why this assertion in cairo would be being hit?
(In reply to Jamie Nicol [:jnicol] from comment #2) > Lee, any idea why this assertion in cairo would be being hit? Unfortunately in the log there does not appear enough to draw any conclusions. The stack trace does not seem to reflect the assertion at all (coming from difference processes). Also, the assertion is hit in system cairo, not tree cairo. But looking at the code, I can only make some general unhelpful guesses: cairo-array is not thread safe (as well for much of cairo that uses it too), so it is possible a race condition could be occurring "somewhere". Also possible is some sort of heap corruption or use-after-free scenario.
Bulk assigning P3 to all open intermittent bugs without a priority set in Firefox components per bug 1298978.