When loading the linked URL in recent Nightlies, I get frequent crashes with the given signatures. Reports include: https://crash-stats.mozilla.com/report/index/f9aefa3f-9f44-41e1-8033-d39222150618 https://crash-stats.mozilla.com/report/index/6d1d5228-da86-499c-9061-050432150618 https://crash-stats.mozilla.com/report/index/d6165e24-a6e5-4205-871c-94c9a2150618 Brian, is bug 1162986 a likely candidate for causing this? Yury's mozregression run indicates it is within the regression range.
20:32.20 LOG: MainThread Bisector INFO Last good revision: dd39dc238ef1 20:32.20 LOG: MainThread Bisector INFO First bad revision: ce863f9d8864 20:32.20 LOG: MainThread Bisector INFO Pushlog: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=dd39dc238ef1&tochange=ce863f9d8864
I can't reproduce this crash.
(In reply to Brian Hackett (:bhackett) from comment #2) > I can't reproduce this crash. I just tried with the current Nightly and a clean profile: after a few (in this case: three) reloads, each after letting the page run for maybe a second or two, the tab crashed. With e10s disabled, a crash occurred after the first reload.
Created attachment 8625105 [details] [diff] [review] patch OK, thanks, I was eventually able to get this to reproduce. After bug 1162986 we need to take care during IonBuilder to look for nursery objects when reading prototypes off a group or object, as the existence of prototype nursery objects does not mean compilations will automatically be canceled by minor GCs. So there are these checkNurseryObject calls sprinkled around IonBuilder, and I missed a spot where this was needed (I don't see any others like this, though).
Assignee: nobody → bhackett1024
Attachment #8625105 - Flags: review?(jdemooij)
Attachment #8625105 - Flags: review?(jdemooij) → review+
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox41: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla41
You need to log in before you can comment on or make changes to this bug.