+++ This bug was initially created as a clone of Bug #1244828 +++ Nicolas requests that each stack should have it's own bug, blocking meta bug 1244824. Assigning to him by default. Line numbers from m-c rev b2a3dc4b161f: #0 js::LifoAlloc::allocInfallibleOrAssert (this=<optimized out>, n=32) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281 #1 js::jit::TempAllocator::allocateInfallible (this=<optimized out>, bytes=32) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40 #2 js::jit::TempObject::operator new (nbytes=32, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174 #3 js::jit::Range::NewUInt32Range (alloc=..., l=0, h=2147483647) at /home/ubuntu/trees/mozilla-central/js/src/jit/RangeAnalysis.h:425 #4 js::jit::MTypedArrayLength::computeRange (this=<optimized out>, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/RangeAnalysis.cpp:1759 #5 0x0000000000804c8f in js::jit::RangeAnalysis::analyze (this=0x7f1217d10bd0) at /home/ubuntu/trees/mozilla-central/js/src/jit/RangeAnalysis.cpp:2250 #6 0x00000000006a0c69 in js::jit::OptimizeMIR (mir=0x32fd8d0) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:1733 #7 0x00000000006a2743 in js::jit::CompileBackEnd (mir=0x32fd8d0) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2008 #8 0x0000000000b1a108 in js::HelperThread::handleIonWorkload (this=0x29d45f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1276 #9 0x0000000000b196e4 in js::HelperThread::threadLoop (this=0x29d45f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1603 #10 0x0000000000c0013e in nspr::Thread::ThreadRoutine (arg=0x29df740) at /home/ubuntu/trees/mozilla-central/js/src/vm/PosixNSPR.cpp:45 #11 0x00007f121a5ae6aa in start_thread (arg=0x7f1217d11700) at pthread_create.c:333 #12 0x00007f1219624eed in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109