This bug was filed from the Socorro interface and is report bp-55d43c95-31f9-4f8f-b75f-f51f02160613. ============================================================= Browser crash since Firefox47 Regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?startdate=3+days+ago&enddate=now Disable baselineJIT seems fixed the crash. And, No longer crash on Firefox48.0b1. Fixed window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=2a8ca5caae8e3a300701b0a85e5051ead55e0648&tochange=ca768ab10b5bf6ac295cb2470bb50fea14cb5324

Steps To Reproduce: 1. (prepare) 1-1. Disable e10s 1-2. Install a add-on attachment 8762450 [details] 1-3. Extract attachment 8762451 [details] to the user profile as follow user profile/chrome/userChrome.js user profile/chrome/UserScriptLoader/PageExpand.user.js 1-4. Restart 2. Open http://anago.2ch.net/test/read.cgi/software/1403862529/l50 in 1st tab Actual Results: Browser crashes

sorry, Regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=9fa27883caa1e0d5b4565b4ed40c653388e9aa19&tochange=6c91719ddb14a1088919291ff63f1bb46bf1db5c

(In reply to Alice0775 White from comment #3) > sorry, > > Regression window: > https://hg.mozilla.org/integration/mozilla-inbound/ > pushloghtml?fromchange=9fa27883caa1e0d5b4565b4ed40c653388e9aa19&tochange=6c91 > 719ddb14a1088919291ff63f1bb46bf1db5c Via local build Last good: 35cdeaef79ab +6c91719ddb14 First Bad: 320b84c9e321 +b8dce586f413+6c91719ddb14 Regressed by: 320b84c9e321 simplyblue — Bug 1212533 - Change the out-param of js/JS::Construct from MutableHandleValue to MutableHandleObject. r=arai, r=jorendorff

This may be a valid crash/regression in 47 but it is not severe enough (based on 2 weeks of being on release channel) to be included in a dot release. Wontfix for 47.

Crash volume for signature 'js::TypeSet::GetValueType': - nightly (version 50): 3 crashes from 2016-06-06. - aurora (version 49): 5 crashes from 2016-06-07. - beta (version 48): 419 crashes from 2016-06-06. - release (version 47): 2051 crashes from 2016-05-31. - esr (version 45): 42 crashes from 2016-04-07. Crash volume on the last weeks: W. N-1 W. N-2 W. N-3 W. N-4 W. N-5 W. N-6 W. N-7 - nightly 1 0 0 0 1 1 0 - aurora 0 1 2 0 1 1 0 - beta 74 52 26 49 63 62 59 - release 289 311 255 234 268 267 283 - esr 3 3 4 6 2 4 5 Affected platform: Windows

(In reply to Alice0775 White from comment #4) > Via local build > Last good: 35cdeaef79ab +6c91719ddb14 > First Bad: 320b84c9e321 +b8dce586f413+6c91719ddb14 > > Regressed by: 320b84c9e321 simplyblue — Bug 1212533 - Change the out-param > of js/JS::Construct from MutableHandleValue to MutableHandleObject. r=arai, > r=jorendorff Could this patch cause these crashes?

I cannot reproduce the crash with the STR Comment#2 on 49 and later. Should I mark this bug as WFM?

(In reply to Alice0775 White from comment #8) > I cannot reproduce the crash with the STR Comment#2 on 49 and later. > > Should I mark this bug as WFM? Good catch. I didn't interpret comment 6 correctly. Thanks for testing on 49+! Marking as WFM.