Bug#836533: Firefox crashes in js::jit::SnapshotIterator::numAllocations(). Possibly GCC 6-related?

[Torbjörn Andersson]

Package: firefox
Version: 48.0-1+b1

Ever since the most recent update, Firefox has crashed, sometimes just a 
few seconds after restoring my previous session. The backtrace typically 
looks something like this:

(gdb) bt
#0  0x000000000000021d in ?? ()
#1  0x00007ffff4cc3397 in js::jit::SnapshotIterator::numAllocations 
(this=0x7fffffffa140) at 
/build/firefox-DAd6ul/firefox-48.0/js/src/jit/JitFrames.cpp:2022
#2  js::jit::IonFrameStackDepthOp::IonFrameStackDepthOp (frame=..., 
this=<optimized out>) at 
/build/firefox-DAd6ul/firefox-48.0/js/src/jit/JitFrames.cpp:359
#3  js::jit::TryNoteIterIon::TryNoteIterIon (frame=..., 
cx=0x7fffb8b61000, this=0x7fffffffa100) at 
/build/firefox-DAd6ul/firefox-48.0/js/src/jit/JitFrames.cpp:369
#4  js::jit::HandleExceptionIon (overrecursed=0x7fffffff9fef, 
rfe=0x7fffffffa5a0, frame=..., cx=0x7fffb8b61000) at 
/build/firefox-DAd6ul/firefox-48.0/js/src/jit/JitFrames.cpp:416
#5  js::jit::HandleException (rfe=0x7fffffffa5a0) at 
/build/firefox-DAd6ul/firefox-48.0/js/src/jit/JitFrames.cpp:791

A similar backtrace was posted in 
https://bugzilla.mozilla.org/show_bug.cgi?id=1245783

And also in a couple of Icedove bug reports, though they appear to have 
been fixed in 45.2.0-3 with the following comment:

   * [a459d6a] debian/rules: adding one more CFLAGS/CXXFLAGS compiler flag
     (Closes: #833864, #833532, #833591, #833635, #833698)

Perhaps a similar fix will work in Firefox as well?

Regards,

Torbjörn Andersson