(function() { var x = new Int32Array(ArrayBuffer()); a = Array.buildPar(6, function() { return new function() { Object.defineProperty(this, "", ({ enumerable: (x[7] % 6 != 0) })); }() }) })() print(uneval(a)) $ ./js-dbg-opt-32-dm-nsprBuild-darwin-174e75a23eaf --fuzzing-safe --ion-offthread-compile=off 87375.js [{'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}] $ ./js-dbg-opt-32-dm-nsprBuild-darwin-174e75a23eaf --fuzzing-safe --ion-offthread-compile=off --ion-eager 87375.js [{'':(void 0)}, {}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}] Tested this on m-c rev 174e75a23eaf. My configure flags are: LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-debug --enable-optimize --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-nspr-build Shu-yu, any idea what's going on here?

No idea. I can't reproduce: shu@pikashu ~/moz/central-hg/js/src/DebugOpt % dist/bin/js --ion-offthread-compile=off ~/moz/central/js/src/Debug/fuzz.js [{'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}] shu@pikashu ~/moz/central-hg/js/src/DebugOpt % dist/bin/js --ion-offthread-compile=off --ion-eager ~/moz/central/js/src/Debug/fuzz.js [{'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}] shu@pikashu ~/moz/central-hg/js/src/DebugOpt % hg tip changeset: 199861:174e75a23eaf

Re-needinfo if you have a bisection.

autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/b66e279688a1 user: Dan Gohman date: Thu May 08 18:34:49 2014 -0700 summary: Bug 998580 - IonMonkey: Generalize RangeAnalysis truncation to handle other kinds of paths to integer types. r=nbp Dan, any idea if bug 998580 is related?

A supposedly infallible LoadTypedArrayElementStatic still does bounds checking, but it returns 0 on an out-of-bounds access rather than undefined. A truncate kind of truncate-after-bailouts is insufficient to mark a LoadTypedArrayElementStatic as infallible. This bug was 32-bit x86 only because only 32-bit x86 uses LoadTypedArrayElementStatic (see bug 864214).