When loading the linked URL in recent Nightlies, I get frequent crashes with the given signatures. Reports include: https://crash-stats.mozilla.com/report/index/f9aefa3f-9f44-41e1-8033-d39222150618 https://crash-stats.mozilla.com/report/index/6d1d5228-da86-499c-9061-050432150618 https://crash-stats.mozilla.com/report/index/d6165e24-a6e5-4205-871c-94c9a2150618 Brian, is bug 1162986 a likely candidate for causing this? Yury's mozregression run indicates it is within the regression range.

20:32.20 LOG: MainThread Bisector INFO Last good revision: dd39dc238ef1 20:32.20 LOG: MainThread Bisector INFO First bad revision: ce863f9d8864 20:32.20 LOG: MainThread Bisector INFO Pushlog: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=dd39dc238ef1&tochange=ce863f9d8864

I can't reproduce this crash.

(In reply to Brian Hackett (:bhackett) from comment #2) > I can't reproduce this crash. I just tried with the current Nightly and a clean profile: after a few (in this case: three) reloads, each after letting the page run for maybe a second or two, the tab crashed. With e10s disabled, a crash occurred after the first reload.

OK, thanks, I was eventually able to get this to reproduce. After bug 1162986 we need to take care during IonBuilder to look for nursery objects when reading prototypes off a group or object, as the existence of prototype nursery objects does not mean compilations will automatically be canceled by minor GCs. So there are these checkNurseryObject calls sprinkled around IonBuilder, and I missed a spot where this was needed (I don't see any others like this, though).