Linux Crash on Firefox 4 Beta 6 and 4.0b6pre - http://crash-stats.mozilla.com/report/list?signature=js::mjit::JaegerShot - from Reports/Comments it seems to happen as startup crahs and also on topsites like spiegel.de Crashing Thread Frame Module Signature [Expand] Source 0 @0xaff0147d 1 libxul.so js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:760 2 libxul.so js::RunScript js/src/jsinterp.cpp:465 3 libxul.so js::Invoke js/src/jsinterp.cpp:614 4 libxul.so array_extra js/src/jsarray.cpp:2781 5 libxul.so CallCompiler::generateNativeStub js/src/methodjit/MonoIC.cpp:469 6 libxul.so js::mjit::ic::NativeCall js/src/methodjit/MonoIC.cpp:707 7 @0xaff009ed 8 libxul.so js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:760 9 libxul.so js::RunScript js/src/jsinterp.cpp:465 10 libxul.so js::Invoke js/src/jsinterp.cpp:614 11 libxul.so array_extra js/src/jsarray.cpp:2781 12 libxul.so CallCompiler::generateNativeStub js/src/methodjit/MonoIC.cpp:469 13 libxul.so js::mjit::ic::NativeCall js/src/methodjit/MonoIC.cpp:707 14 @0xb102529e 15 libxul.so js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:760 16 libxul.so js::RunScript js/src/jsinterp.cpp:465 17 libxul.so js::Invoke js/src/jsinterp.cpp:614 18 libxul.so js::ExternalInvoke js/src/jsinterp.cpp:644 19 libxul.so JS_CallFunctionValue js/src/jsinterp.h:729 20 libxul.so nsJSContext::CallEventHandler dom/base/nsJSEnvironment.cpp:2186 21 libxul.so nsJSEventListener::HandleEvent dom/src/events/nsJSEventListener.cpp:228 22 libxul.so nsEventListenerManager::HandleEventSubType content/events/src/nsEventListenerManager.cpp:1112 23 libxul.so nsEventListenerManager::HandleEventInternal content/events/src/nsEventListenerManager.cpp:1208 24 libxul.so nsEventTargetChainItem::HandleEvent content/events/src/nsEventListenerManager.h:146 25 libxul.so nsEventTargetChainItem::HandleEventTargetChain content/events/src/nsEventDispatcher.cpp:341 26 libxul.so nsEventDispatcher::Dispatch content/events/src/nsEventDispatcher.cpp:628 27 libxul.so DocumentViewerImpl::LoadComplete layout/base/nsDocumentViewer.cpp:1033 28 libxul.so nsDocShell::EndPageLoad docshell/base/nsDocShell.cpp:6030 29 libxul.so nsDocShell::OnStateChange docshell/base/nsDocShell.cpp:5857 30 libxul.so nsDocLoader::FireOnStateChange uriloader/base/nsDocLoader.cpp:1334 31 libxul.so nsDocLoader::doStopDocumentLoad uriloader/base/nsDocLoader.cpp:942 32 libxul.so nsDocLoader::DocLoaderIsEmpty uriloader/base/nsDocLoader.cpp:818 33 libxul.so nsDocLoader::OnStopRequest uriloader/base/nsDocLoader.cpp:702 34 libxul.so nsLoadGroup::RemoveRequest netwerk/base/src/nsLoadGroup.cpp:680 35 libxul.so nsDocument::DoUnblockOnload content/base/src/nsDocument.cpp:7291 36 libxul.so nsBindingManager::DoProcessAttachedQueue content/xbl/src/nsBindingManager.cpp:999 37 libxul.so nsRunnableMethodImpl<void , true>::Run nsThreadUtils.h:347 38 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:547 39 libxul.so NS_ProcessNextEvent_P nsThreadUtils.cpp:250 40 libxul.so nsXMLHttpRequest::Send content/base/src/nsXMLHttpRequest.cpp:2666 41 libxul.so nsIXMLHttpRequest_Send dom_quickstubs.cpp:25139 42 libxul.so js::Interpret js/src/jsinterp.cpp:4611 43 libxul.so js::RunScript js/src/jsinterp.cpp:468 44 libxul.so js::Invoke js/src/jsinterp.cpp:614 45 libxul.so array_extra js/src/jsarray.cpp:2781 46 libxul.so js::Interpret js/src/jsinterp.cpp:4611 47 libxul.so js::RunScript js/src/jsinterp.cpp:468 48 libxul.so js::Invoke js/src/jsinterp.cpp:614 49 libxul.so js::ExternalInvoke js/src/jsinterp.cpp:644 50 libxul.so JS_CallFunctionValue js/src/jsinterp.h:729 51 libxul.so nsJSContext::CallEventHandler dom/base/nsJSEnvironment.cpp:2186 52 libxul.so nsGlobalWindow::RunTimeout dom/base/nsGlobalWindow.cpp:8588 53 libxul.so nsGlobalWindow::TimerCallback dom/base/nsGlobalWindow.cpp:8933 54 libxul.so nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:425 55 libxul.so nsTimerEvent::Run xpcom/threads/nsTimerImpl.cpp:517 56 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:547 57 libxul.so NS_ProcessNextEvent_P nsThreadUtils.cpp:250 58 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:110 59 libxul.so MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:219 60 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:202 61 libxul.so nsBaseAppShell::Run widget/src/xpwidgets/nsBaseAppShell.cpp:180 62 libxul.so nsAppStartup::Run toolkit/components/startup/src/nsAppStartup.cpp:191 63 @0xb77f1e93 64 libxul.so XRE_main toolkit/xre/nsAppRunner.cpp:3665 65 firefox-bin main browser/app/nsBrowserApp.cpp:158 66 libc-2.12.1.so libc-2.12.1.so@0x16c75 67 firefox-bin firefox-bin@0x1390 68 firefox-bin Output browser/app/nsBrowserApp.cpp:77 69 @0x0

This may be bug 596457. All the crashes are SIGILL, most of the uptimes are extremely short, and the CPUs are very old.

(In reply to comment #1) > This may be bug 596457. All the crashes are SIGILL, most of the uptimes are > extremely short, and the CPUs are very old. checking 64 reports from js::mjit::JaegerShot crashes in 20100914-crashdata.csv 22 CPU|x86|AuthenticAMD family 6 model 10 stepping 0|1 2 CPU|x86|AuthenticAMD family 6 model 3 stepping 1|1 14 CPU|x86|AuthenticAMD family 6 model 6 stepping 2|1 1 CPU|x86|AuthenticAMD family 6 model 7 stepping 1|1 12 CPU|x86|AuthenticAMD family 6 model 8 stepping 1|1 8 CPU|x86|GenuineIntel family 6 model 11 stepping 1|1 2 CPU|x86|GenuineIntel family 6 model 11 stepping 4|1 2 CPU|x86|GenuineIntel family 6 model 8 stepping 10|1 1 CPU|x86|GenuineIntel family 6 model 8 stepping 6|1

should be fixed by 596457

ao far, so good date tl crashes at js::mjit::JaegerShot , count build, count build, ... 20100910 3 2 4.0b6pre2010090903, 1 4.0b6pre2010090803, 20100911 20100912 74 4.0b6pre2010091203 74 , 20100913 63 39 4.0b6pre2010091303, 24 4.0b6pre2010091203, 20100914 64 43 4.0b7pre2010091403, 18 4.0b6pre2010091303, 2 4.0b6pre2010091403, 1 4.0b6pre2010090903, 20100915 20100916 31 17 4.0b7pre2010091603, 9 4.0b7pre2010091503, 3 4.0b7pre2010091403, 1 4.0b6pre2010091303, 1 4.0b6pre2010091203, 20100917 9 4 4.0b7pre2010091503, 3 4.0b7pre2010091603, 2 4.0b7pre2010091403, 20100918 2 1 4.0b7pre2010091503, 1 4.0b7pre2010091403, 20100919 20100920 1 4.0b7pre2010091503 1 , 20100921 20100922 20100923 1 4.0b7pre2010091503 1 ,

It is not fixed. It happens on linux and Mac OS X. It is #3 top crasher in b8pre/20101015 build on linux. More reports at: http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=js%3A%3Amjit%3A%3AJaegerShot

There's no evidence these crashes are related, like bug 595351 and bug 604371. There's not a lot of point to having multiple variants around and reopening old ones.

So it is a meta bug. If we keep the 4 first frames of each stack trace, last month crashes are breakdown as follow: * 6 crashes with this stack trace: 1 libxul.so js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:742 2 libxul.so js::Invoke js/src/jsinterp.cpp:635 3 libxul.so js_fun_apply js/src/jsfun.cpp:2369 5 libxul.so js::mjit::EnterMethodJIT js/src/methodjit/MethodJIT.cpp:742 * 5 crashes with this stack trace: 2 XUL js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:752 3 XUL js::Invoke js/src/jsinterp.cpp:635 4 XUL js::ExternalInvoke js/src/jsinterp.cpp:776 5 XUL JS_CallFunctionValue js/src/jsinterp.h:937 * 4 crashes with this stack trace: 1 libxul.so js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:742 2 libxul.so js::Execute js/src/jsinterp.cpp:635 3 libxul.so JS_EvaluateUCScriptForPrincipals js/src/jsapi.cpp:4882 4 libxul.so JS_EvaluateUCScriptForPrincipalsVersion js/src/jsapi.cpp:4858 * 2 crashes with this stack trace: 1 libxul.so js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:771 2 libxul.so js::Invoke js/src/jsinterp.cpp:481 3 libxul.so array_extra js/src/jsarray.cpp:2780 4 libxul.so CallCompiler::generateNativeStub js/src/methodjit/MonoIC.cpp:455 * 1 crash with this stack trace: 1 libxul.so js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:785 2 libxul.so js::Invoke js/src/jsinterp.cpp:481 3 libxul.so js_fun_apply js/src/jsfun.cpp:2389 4 libxul.so CallCompiler::generateNativeStub js/src/methodjit/MonoIC.cpp:460 * 1 crash with this stack trace (bug 602810): 1 libxul.so js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:760 2 libxul.so js::RunScript js/src/jsinterp.cpp:465 3 libxul.so js::Invoke js/src/jsinterp.cpp:614 4 libxul.so js::ExternalInvoke js/src/jsinterp.cpp:644 * 1 crash with this stack trace: 1 libxul.so js::mjit::JaegerShot js/src/methodjit/MethodJIT.cpp:760 2 libxul.so js::Execute js/src/jsinterp.cpp:465 3 libxul.so JS_EvaluateUCScriptForPrincipals js/src/jsapi.cpp:4674 4 libxul.so nsJSContext::EvaluateString dom/base/nsJSEnvironment.cpp:1749

Should we dupe this off to bug 595351? This appears to be the OSX/Linux variant of that signature.

... though the other open question is whether we're getting the necessary information in OS X and Linux minidumps. Windows minidumps aren't going to be sufficient for solving 64-bit-specific JIT issues.

Crashes my x86-64 Linux nightly every 15 minutes of use. bp-2d465f5a-d715-4b02-8c95-b95642101028

The crashes here on OS X happen ever few minutes. Have been on each day during October. The sudden death crashes makes firefox 100% unusable. This is a huge showstopper. 2d465f5a-d715-4b02-8c95-b95642101028

Yeah, it's getting worse, 20101101 x86-64 Linux crashes every two minutes.

This is really moving up on our list. Adding the topcrash keyword to help track it.

What exactly does "crashes every X minutes" mean? That it crashes after X minutes of running the browser exactly? That it crashes after that many minutes on average? If it truly does have a precise interval, it is probably some kind of background process. I see that 89% of these happen on 8-core amd64 machines, which also points in that direction.

Here are my crashes from yesterday (I've installed 4.0b5 now): bp-e67f9c3a-89bd-4750-9f92-7d3e3 210110111/02/2010 04:53 AM bp-753b181c-a75e-40a4-8eef-8eaa8 210110111/02/2010 04:51 AM bp-f5043b3f-94ee-4e3b-9e5d-2dc07 210110111/02/2010 04:49 AM bp-874113d8-8f1e-4822-9d58-8cab5 210110111/02/2010 04:47 AM bp-e424f8df-447d-40fe-93c8-5c90e 210110111/02/2010 04:45 AM bp-52903aec-944e-4689-a740-fc4fb 210110111/02/2010 04:43 AM bp-5356b578-f566-4b25-be39-45571 210110111/02/2010 04:41 AM bp-b1a0f162-dc1b-4ac2-8703-b529b 210110111/02/2010 04:39 AM bp-3750cfa9-c3fa-4102-92b0-283b9 210110111/02/2010 04:36 AM bp-7c0c3972-9c62-46a5-86dd-78668 210110111/02/2010 04:34 AM bp-1ceeab2e-1c98-4073-9804-561e5 210110111/02/2010 04:32 AM bp-ce76b3f6-2710-400d-9b4d-e97bf 210110111/02/2010 04:30 AM bp-51b1f110-1c9a-4e0a-84ea-2a0c2 210110111/02/2010 04:28 AM bp-1c88704b-7aee-4b46-91c0-040a8 210110111/02/2010 04:26 AM bp-29be1b60-ac32-4341-b4ac-750ce 210110111/02/2010 04:24 AM bp-9259ac28-9384-4802-922d-24b8a 210110111/02/2010 04:21 AM bp-c62a36c0-bcbe-4e23-8dbb-36b85 210110111/02/2010 04:17 AM bp-a2fc7805-7bdb-43b0-a392-3b612 210110111/02/2010 04:14 AM bp-0b2930cf-a8f0-4940-9420-0bf5b 210110111/02/2010 04:11 AM bp-d699498d-3233-4708-8236-e34d9 210110111/02/2010 04:09 AM bp-3c0a0777-5627-410e-a4ce-74ab3 210110111/02/2010 04:07 AM bp-088bd983-22f4-41ae-81e3-33344 210110111/02/2010 04:05 AM bp-6af78555-dd8f-4b69-bdca-00a91 210110111/02/2010 04:03 AM bp-efcb16c0-b5b4-42aa-9201-d1bdb 210110111/02/2010 04:00 AM bp-da20f476-1c4c-4f78-aff5-59e04 210110111/02/2010 03:55 AM bp-c1ec4209-723e-40bf-85e4-81257 210110111/02/2010 03:54 AM bp-02420349-ab60-4477-ad25-5fdb6 210110111/02/2010 03:52 AM bp-dfa296e6-0e91-48cc-9d0e-1e024 210110111/02/2010 03:50 AM bp-55e07f18-0e75-4973-bbdf-ba2f1 210110111/02/2010 03:48 AM bp-aacaa9c9-0d02-47db-8cf2-4fd44 210110111/02/2010 03:47 AM bp-274dbdf2-d3d7-449e-8d47-101a9 210110111/02/2010 03:43 AM 082a8dd0-1774-dce6-12a6a24e-7f81d93a11/02/2010 03:41 AM 768b4479-b6ae-78bf-71b00cf4-31cd75b411/02/2010 03:39 AM bp-8489a4a1-a777-4e53-b5c2-a3549 210110111/02/2010 03:37 AM bp-d96d6fdf-89c5-4c5f-bada-811d8 210110111/02/2010 03:37 AM bp-7f5b848d-e4eb-40de-90a3-5d8e6 210110111/02/2010 03:36 AM bp-b4d7b9d5-5fe3-432c-9768-026ea 210110111/02/2010 03:36 AM bp-f5c130c0-3ef4-4439-a06e-5a188 210110111/02/2010 03:35 AM bp-011b60a5-b6af-4c43-8de7-d35d9 210110111/02/2010 03:30 AM bp-c476975e-209e-4293-badd-c8081 210110111/02/2010 03:28 AM bp-c8a43e63-72e8-4df7-a69b-5b997 210110111/02/2010 03:20 AM

Sorry, got the column spacing wrong, it should be: bp-e67f9c3a-89bd-4750-9f92-7d3e32101101 11/02/2010 04:53 AM ...

Mats: What are the STR to repro this crash? Is it related to one of the addons you have installed? (In reply to comment #16) > Here are my crashes from yesterday (I've installed 4.0b5 now): >

There's no particular STR that I know of, just normal browsing. The crashes are with my default (not-for-testing) profile. In this profile I have the following add-ons: Adblock Plus 1.2.2 DOM Inspector 2.0.8 Linky 3.0.0 6 plugins which Ubuntu added without asking me. All plugins have been disabled. I haven't tried in safe mode or with a clean profile. In a desperate attempt to avoid crashing I added the prefs: javascript.options.jit.content=false javascript.options.jit.chrome=false which didn't help, it still crashed.

(In reply to comment #19) > There's no particular STR that I know of, just normal browsing. > The crashes are with my default (not-for-testing) profile. > In this profile I have the following add-ons: > Adblock Plus 1.2.2 > DOM Inspector 2.0.8 > Linky 3.0.0 > > 6 plugins which Ubuntu added without asking me. All plugins have been disabled. > > I haven't tried in safe mode or with a clean profile. > In a desperate attempt to avoid crashing I added the prefs: > javascript.options.jit.content=false > javascript.options.jit.chrome=false > which didn't help, it still crashed. Those aren't the right options (they are for Fx3.6). Putting 'jit' in the filter box is the easiest way to see them. To turn off the methodjit, which will probably stop this for you, set javascript.options.methodjit.content = false One thing I wonder is if this could possibly have anything to do with Sync? It was causing a different type of crash earlier, which has been stopped, but maybe some problem remains. Probably not, though. Otherwise, could you get one of these in a debugger? It might help to see the code around the point of the crash, and what memory operation exactly crashed.

Bug 609177 blocks me from giving you a stack with symbols for nightly builds. I also get a crash (fatal assert) in a local DEBUG build - this may be unrelated to the crash in this bug though.

> One thing I wonder is if this could possibly have anything to do with Sync? Possibly. I do have a Sync account in this profile. services.sync.autoconnect is false. It was originally "Sync Everything" but after changing it to "Use my custom settings" and unchecking all the options it still crashed. Is there a better way to temporarily turn off the Sync service completely? (without erasing my config)

http://tinyurl.com/28obo97 - some comments indicate that people have experienced this crash when operating in Gmail.

In addition to the gmail clue, I'll increase the sync'ing frequency (services.sync.syncInterval) to, maybe, increase the chance that my browser crashes if it is related to Sync.

I've had two crashes just now that appear to have been related to the use of Panorama. Not sure if that's just a coincidence. bp-a33f3213-60d0-4519-a165-e38ee2101105 bp-c6f85561-48ae-4cc3-9753-bd37d2101105

(In reply to comment #25) > I've had two crashes just now that appear to have been related to the use of > Panorama. Not sure if that's just a coincidence. > > bp-a33f3213-60d0-4519-a165-e38ee2101105 > bp-c6f85561-48ae-4cc3-9753-bd37d2101105 Just to be clear, I'm running Firefox 4.0b7 (build 1; build ID: 20101104131842) on Mac OS X 10.6.4 (64-bit). I notice that this bug has heretofore been mentioned as Linux-only, but I'm not sure that's the case.

bp-de81fbef-5178-486a-ad04-187722101105 11/5/104:26 PM bp-50d70646-5127-43bb-9fbb-6c7dc2101105 11/5/103:50 PM bp-37bd4210-3a1b-42f3-af4c-df5c42101105 11/5/103:43 PM bp-4485a434-a05d-46bf-98f1-a5d9d2101105 11/5/103:38 PM bp-e1409280-390a-455f-8f1a-d4f692101105 11/5/103:32 PM bp-0cbeb48a-2b08-4fb7-8daf-86e5e2101105 11/5/103:30 PM bp-429c7861-8f2a-48b0-bc53-72bd82101105 11/5/103:28 PM bp-17be309f-f329-4295-b7dd-7e3e42101105 11/5/103:24 PM bp-e5b9960a-3d7d-44b1-854d-80e482101105 11/5/103:20 PM bp-c60794b8-bb50-43e8-a864-225712101105 11/5/103:13 PM bp-206070c5-2795-4406-9675-0a30d2101105 11/5/102:52 PM I had to go back to 1104, 1105 was crashing all the time. Can anyone (dvander, dmandelin, sayrer) see suspects among the m-c changes from that build to today's? I'm running mac64 here, is there a separate bug on 64-bit JM crashes? /be

I saw this twice after installing beta 7 on 64 bit mac

If the crash graph is any indication, something new in the 20101028 build caused a major increase in the number of crashes for this latest round.

I crashes with a stack which looks like this bug today on a recent nightly: bp-fee63056-2fd9-494e-a2c8-182e62101110

(In reply to comment #28) > I saw this twice after installing beta 7 on 64 bit mac On OSX10.6, I upgraded from b6 -> b7, and on restart, it crashed. I've now crashed 7 times in a row on restart. Crash report says all were on js/src/methodjit/MethodJIT.cpp:739, and points me to this bug.

(In reply to comment #31) > (In reply to comment #28) > > I saw this twice after installing beta 7 on 64 bit mac > > On OSX10.6, I upgraded from b6 -> b7, and on restart, it crashed. I've now > crashed 7 times in a row on restart. Crash report says all were on > js/src/methodjit/MethodJIT.cpp:739, and points me to this bug. John, that sounds like bug 602333, for which a patch is up.

(In reply to comment #32) > (In reply to comment #31) > > (In reply to comment #28) > > > I saw this twice after installing beta 7 on 64 bit mac > > > > On OSX10.6, I upgraded from b6 -> b7, and on restart, it crashed. I've now > > crashed 7 times in a row on restart. Crash report says all were on > > js/src/methodjit/MethodJIT.cpp:739, and points me to this bug. > > John, that sounds like bug 602333, for which a patch is up. Correction: a diagnostic patch is up for review.

John: mac64? Me too -- dvander diagnosed the crash when I caught it in gdb and that led to bug 602333. In the mean time I've had to pref off methodjit. /be

(In reply to comment #34) > John: mac64? Me too -- dvander diagnosed the crash when I caught it in gdb and > that led to bug 602333. In the mean time I've had to pref off methodjit. > > /be Brendan: Yes, I'm on OSX10.6.4. Following your suggestion, I changed javascript.options.methodjit.content to false, restarted Firefox and no crash-on-startup! I've even been able to reenable some plugins/addons and so far so good! :-) Thanks for the tip.

Would be helpful know which extensions you have running so we can try to reproduce. So far I haven't seen this during my testing. (In reply to comment #35)

52 crashes since installation of 4.0 beta 7, 11-11-2011 and specially crash in Wikipedia. For today, bp-7f4f989c-9599-466c-b134-f8c0f210111414/11/201018:14 bp-b218772a-1b11-434a-afe4-d67f4210111414/11/201016:51 bp-fd744425-d2c6-4eb4-9fff-92206210111414/11/201015:32 bp-abb5303e-fe56-4d67-a73e-88755210111414/11/201011:27 bp-86d1e44f-a591-4af4-8e20-49883210111414/11/201010:39 bp-37753aa6-1512-4aa6-8714-74c2c210111314/11/201007:19 bp-3b55ca4a-85ff-4f4c-8a01-d19aa210111314/11/201006:36 I am running 64 bits version on Ubuntu 10.10

Should we dupe this off to bug 602333 or do we suspect the fix will come in that bug?

Let's wait and see what happens after bug 602333 is fixed.

Bummer, this just went to blocking beta9+. It is a terrible bug in beta8 on OS X. With a bunch of people setting javascript.options.methodjit.content to false it no longer crashes constantly. Hopefully this doesn't place it much lower in the fix priority list since it doesn't show up as much on crash-stats.mozilla.com (?) Is the new JägerMonkey code only used when javascript.options.methodjit.content = true ? What does the setting do?

(In reply to comment #40) > Bummer, this just went to blocking beta9+. Because there is no "one bug" here - any JIT crash of any kind will show under this crash signature. It's hard to block on that. What we can do though is file bugs on specific problems and block on those - like bug 602333 (which is b8+) that will fix a huge portion of OS X crashes.

Mac and Linux crashes with this signature have all but disappeared after bug 602333 landed. There's still one more patch to land that should cover the remaining cases. Other crashes that appear with this signature should be filed under a new bug.

For my case (+100 crashes), I was running Firefox with export MOZ_ACCELERATED=11 without this option, il works like a charm :-)