Hi all, This is just a quick heads-up to advise that I've found quite a nasty bug in the Mozilla Javascript engine: https://bugzilla.mozilla.org/show_bug.cgi?id=1143022

On systems running with a 48-bit VA, bit [47] is being incorrectly masked out by the Javascript engine due to it being used internally for tagging. This will cause random crashes (depending upon where mmap returns memory).

In my case it even prevented the system from booting properly due to polkitd crashing.

I would recommend anyone packaging the Mozilla Javascript engine to keep an eye on this bug, I've flagged it as a "blocker".

Cheers, -- Steve