I'm seeing this crash quite regularly in my line of testing. If wanted, I could try and come up with a testcase (more or less). Slightly educated guess, it might have something to do with flash plugins or something. http://crash-stats.mozilla.com/report/index/9ed98f63-9b82-11dd-8a65-001cc45a2c28?p=1 0 js3250.dll nanojit::LirBufWriter::insImm js/src/nanojit/LIR.cpp:420 1 js3250.dll nanojit::CseFilter::insImm js/src/nanojit/LIR.cpp:1731 2 js3250.dll nanojit::LirWriter::ins2i js/src/nanojit/LIR.cpp:643 3 js3250.dll TraceRecorder::test_property_cache js/src/jstracer.cpp:3620 4 js3250.dll TraceRecorder::record_JSOP_CALLPROP js/src/jstracer.cpp:6632 5 js3250.dll js3250.dll@0x69be2 6 js3250.dll js_Invoke js/src/jsinterp.cpp:1324 7 js3250.dll JS_CallFunctionValue js/src/jsapi.cpp:5136 8 xul.dll nsJSContext::CallEventHandler dom/src/base/nsJSEnvironment.cpp:2012 9 xul.dll nsGlobalWindow::RunTimeout dom/src/base/nsGlobalWindow.cpp:7658 10 xul.dll nsGlobalWindow::TimerCallback dom/src/base/nsGlobalWindow.cpp:7990 11 xul.dll nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:420 12 xul.dll nsTimerEvent::Run xpcom/threads/nsTimerImpl.cpp:512 13 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:510 14 xul.dll nsBaseAppShell::Run widget/src/xpwidgets/nsBaseAppShell.cpp:170 15 nspr4.dll PR_GetEnv 16 firefox.exe wmain toolkit/xre/nsWindowsWMain.cpp:87 17 firefox.exe firefox.exe@0x2197 18 kernel32.dll BaseProcessStart

also on Linux, bp-37b8e690-5b1c-4eb7-935f-790120081115 Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b2pre) Gecko/20081115 SeaMonkey/2.0a2pre - Build ID: 20081115000503 crash at browser startup, loaded by clicking the Browser icon at bottom left of the MailNews window. No crash on restart immediately afterwards. Crashing Thread Frame Module Signature [Expand] Source 0 libmozjs.so nanojit::LirBufWriter::insImm js/src/nanojit/LIR.cpp:614 1 libmozjs.so nanojit::CseFilter::insImm js/src/nanojit/LIR.cpp:1901 2 libmozjs.so nanojit::LirWriter::insImm js/src/jsregexp.cpp:462 3 libmozjs.so nanojit::LirWriter::insImm js/src/jsregexp.cpp:462 4 libmozjs.so nanojit::LirWriter::insLoad js/src/nanojit/LIR.cpp:970 5 libmozjs.so TraceRecorder::import js/src/jstracer.cpp:1483 6 libmozjs.so TraceRecorder::lazilyImportGlobalSlot js/src/jstracer.cpp:1580 7 libmozjs.so TraceRecorder::activeCallOrGlobalSlot js/src/jstracer.cpp:4027 8 libmozjs.so TraceRecorder::name js/src/jstracer.cpp:6413 9 libmozjs.so TraceRecorder::record_JSOP_NAME js/src/jstracer.cpp:6601 10 libmozjs.so js_Interpret js/src/jsopcode.tbl:176 11 libmozjs.so js_Execute js/src/jsinvoke.cpp:1554 12 libmozjs.so JS_EvaluateUCScriptForPrincipals js/src/jsapi.cpp:5187 13 libgklayout.so nsJSContext::EvaluateString dom/src/base/nsJSEnvironment.cpp:1586 14 libgklayout.so nsScriptLoader::EvaluateScript content/base/src/nsScriptLoader.cpp:643 15 libgklayout.so nsScriptLoader::ProcessRequest content/base/src/nsScriptLoader.cpp:557 16 libgklayout.so nsScriptLoader::ProcessPendingRequests content/base/src/nsScriptLoader.cpp:696 17 libgklayout.so nsScriptLoader::OnStreamComplete content/base/src/nsScriptLoader.cpp:874 18 libnecko.so libnecko.so@0x3c62f 19 libnecko.so libnecko.so@0x3c313 20 libnecko.so libnecko.so@0x8e9d4 21 libnecko.so libnecko.so@0x25cfb 22 libnecko.so libnecko.so@0x25fe2 23 libxpcom_core.so libxpcom_core.so@0x4448c 24 libxpcom_core.so libxpcom_core.so@0x58ca7 25 libxpcom_core.so libxpcom_core.so@0x27342 26 libxpcom_core.so libxpcom_core.so@0x59235 27 libxpcom_core.so libxpcom_core.so@0x652f6 28 libxpcom_core.so libxpcom_core.so@0x5d2d4 29 libxpcom_core.so libxpcom_core.so@0x58ca7 30 libxpcom_core.so libxpcom_core.so@0x27342 31 libxpcom_core.so libxpcom_core.so@0x59235 32 libxpcom_core.so libxpcom_core.so@0x652f6 33 libxpcom_core.so libxpcom_core.so@0x5d2d4 34 libxpcom_core.so libxpcom_core.so@0x58ca7 35 libxpcom_core.so libxpcom_core.so@0x27342 36 libwidget_gtk2.so nsBaseAppShell::Run widget/src/xpwidgets/nsBaseAppShell.cpp:170 37 libtoolkitcomps.so nsAppStartup::Run toolkit/components/startup/src/nsAppStartup.cpp:192 38 libxul.so XRE_main 39 seamonkey-bin main nsSuiteApp.cpp:103 40 libc-2.8.so libc-2.8.so@0x165f4 For the record, I got the crash on Linux in SeaMonkey 2.0b2pre 20081115000503, Martijn got it on Windows in Firefox 3.1b2pre 20081013033718.

need a test case

This is showing up in the topcrash lists; it looks like the top crash in those lists that wasn't fixed by the merge two days ago.

Duping forward because of the testcase in the other bug, see bug 467007 comment #8.