If you edit your prefs.js to disable JIT (javascript.options.baselinejit = false) or try to disable JavaScript altogether (java.script.enabled = false), does it crash at the same point?
(I would expect so as these flags have not helped much when troubleshooting in the past, but it's still something I check whenever seeing a backtrace with JS::)
Nice work!
If you edit your prefs.js to disable JIT (javascript. options. baselinejit = false) or try to disable JavaScript altogether (java.script. enabled = false), does it crash at the same point?
(I would expect so as these flags have not helped much when troubleshooting in the past, but it's still something I check whenever seeing a backtrace with JS::)