Build gecko with B2G_DEBUG=y and run on unagi (binary was too big to fit into tarako). STR: Open the browser app and load m.youtube.com

Program received signal SIGSEGV, Segmentation fault. 0x41cad016 in js::jit::LiveInterval::start (this=0xbe972b80) at /gecko/js/src/jit/LiveRangeAllocator.h:267 267 JS_ASSERT(!ranges_.empty()); (gdb) bt #0 0x41cad016 in js::jit::LiveInterval::start (this=0xbe972b80) at /gecko/js/src/jit/LiveRangeAllocator.h:267 #1 js::jit::LiveRangeAllocator<js::jit::LinearScanVirtualRegister, true>::findFirstSafepoint (this=0xbe972b80) at /gecko/js/src/jit/LiveRangeAllocator.h:721 #2 js::jit::LinearScanAllocator::populateSafepoints (this=0xbe972b80) at /gecko/js/src/jit/LinearScan.cpp:496 #3 0x41cb0784 in js::jit::LinearScanAllocator::go (this=0xbe972b80) at /gecko/js/src/jit/LinearScan.cpp:1250 #4 0x41c49d68 in js::jit::GenerateLIR (mir=0x456be140) at /gecko/js/src/jit/Ion.cpp:1406 #5 0x41c4a03e in js::jit::CompileBackEnd (mir=0x456be140, maybeMasm=0x0) at /gecko/js/src/jit/Ion.cpp:1497 #6 0x41c4ae04 in IonCompile (cx=0x40464d90, script=..., osrFrame=<value optimized out>, osrPc=<value optimized out>, constructing=false, executionMode=js::SequentialExecution) at /gecko/js/src/jit/Ion.cpp:1721 #7 Compile (cx=0x40464d90, script=..., osrFrame=<value optimized out>, osrPc=<value optimized out>, constructing=false, executionMode=js::SequentialExecution) at /gecko/js/src/jit/Ion.cpp:1893 #8 0x41c4b052 in js::jit::CompileFunctionForBaseline (cx=0x40464d90, script=..., frame=0xbe972fa0, isConstructing=false) at /gecko/js/src/jit/Ion.cpp:2064 #9 0x4200c736 in EnsureCanEnterIon (cx=0x40464d90, stub=<value optimized out>, frame=0xbe972fa0, infoPtr=0xbe972f74) at /gecko/js/src/jit/BaselineIC.cpp:764 #10 DoUseCountFallback (cx=0x40464d90, stub=<value optimized out>, frame=0xbe972fa0, infoPtr=0xbe972f74) at /gecko/js/src/jit/BaselineIC.cpp:929 #11 0x4356c51c in ?? () #12 0x4356c51c in ?? () Backtrace stopped: previous frame identical to this frame (corrupt stack?) (gdb)

nominate 1.3t? first for triage.

to Tingyuan for initial investigation for now

Looks like bug 959328

triage; let's not block tarako reelase with this, ting-yuan, can you please continue looking at this bug, if we have a safe solution ,let's evaluate if we can uplift to 1.3T thanks

The assertion failure in the bug title is exactly same to the bug 958432, which was already resolved in m-c but not in 1.3/1.3t. However, the symptom described in comment 1 looks like bug 959328. Could we close this bug, uplift bug 958432 and then mark 959328 to be 1.3T related?

sure