Further analysis of the dumps from the crash yielded some new information. 1. The crashes are _not_ at return addresses exclusively (that was just a fluke from the first few readings) 2. They do _not_ exclusively happen in baseline mainline jitcode. They seem to originate just as well from ion jitcode or CacheIR code as well.
Bug 1554933 Comment 5 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Wrong bug. Deleted comment.