454852 - TM: crash [@ TraceRecorder::record_SetPropHit(unsigned int, JSScopeProperty*) ] when viewing 'Today' in the history sidebar w/ chrome jit

Status: RESOLVED DUPLICATE of bug 454689

(Core :: JavaScript Engine, defect)

Description

[[e-mail] (:bhearsum)]

STR:
1. Turn on chrome jit
2. Open History sidebar
3. Click 'Today'

Here's a partial stack:
0|0|libmozjs.dylib|TraceRecorder::record_SetPropHit(unsigned int, JSScopeProperty*)|hg:hg.mozilla.org/mozilla-central:js/src/jstracer.cpp:d7b1a5551e2c|4431|0x10 0|1|libmozjs.dylib|TraceRecorder::record_SetPropMiss(JSPropCacheEntry*)|hg:hg.mozilla.org/mozilla-central:js/src/jstracer.cpp:d7b1a5551e2c|4454|0x1b 0|2|libmozjs.dylib|js_Interpret|hg:hg.mozilla.org/mozilla-central:js/src/jsinterp.cpp:d7b1a5551e2c|4605|0x1e 0|3|libmozjs.dylib|js_Invoke|hg:hg.mozilla.org/mozilla-central:js/src/jsinvoke.cpp:d7b1a5551e2c|1326|0x4 0|4|XUL|nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*)|hg:hg.mozilla.org/mozilla-central:js/src/xpconnect/src/xpcwrappedjsclass.cpp:d7b1a5551e2c|1523|0x2a 0|5|XUL|nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*)|hg:hg.mozilla.org/mozilla-central:js/src/xpconnect/src/xpcwrappedjs.cpp:d7b1a5551e2c|565|0x20 0|6|XUL|PrepareAndDispatch(nsXPTCStubBase*, unsigned int, unsigned int*)|hg:hg.mozilla.org/mozilla-central:xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:d7b1a5551e2c|93|0x25 

And my crash report:
http://crash-stats.mozilla.com/report/index/b416c74f-8033-11dd-9b0a-001cc45a2c28

I found another history related crash (bug 451899) - don't know if this is related.