Revert changeset #88c8c874f4b8. #88c8c874f4b8 try to fix crashing, but it blame to wrong code. If you look into runtime stack of xnjsmb_coord_remove(), you will find self argument is already wrong. It is in an invalid address.

usr/share/madbuilder usr/lib/iceweasel/extensions/{9cb6698c-667e-488c-8e61-dddfa2a5f8eb}