User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:46.0) Gecko/20100101 Firefox/46.0 Build ID: 20160101030330 Steps to reproduce: Navigate to http://www.sueddeutsche.de/ with a fresh profile on the latest Nightly build, both Mac OS X and Android. Actual results: Images don't load, see attachment. Expected results: The images should load.

Note: I think this is some kind of Javascript error as all the missing pictures seem to point to http://media-cdn.sueddeutsche.de/globalassets/img/unsprited/placeholder.png, i.e. something prevented the actual image from being loaded after the placeholder.

Regression range: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=f8009a756cd0257a7ce978ebf5d63071ca70affc&tochange=40e6314fcce22384cbf9f87344de47a49525962a Culprit: Bug 1233249

Reduced: function f() { "use strict"; for (d in arguments) { tc = !d; } }

Improbably enough, I think this is a duplicate of bug 1235640 (!). When syntax-parsing we checkAndMarkAsAssignmentLhs |d|, which involves checking for arguments/eval as a forbidden assignment target. When syntax-parsing, we represent nodes as a single integer, *not* tracking the precise name. To know the name associated with a node that was a name, we use a "last atom" concept, that stores the last identifier name or string literal seen while parsing. *But*. We checkAndMarkAsAssignmentLhs for for-in/of loops, *not* immediately after |d| has been parsed, but after |d in arguments| has been parsed. So the last name/identifier/string literal in the right-hand side of the for-in/of loop head, is what's considered -- "arguments", not "d". And so this currently-mistaken behavior: js> function f() { "use strict"; for (d in arguments) { tc = !d; } } typein:1:39 SyntaxError: can't assign to arguments in strict mode: typein:1:39 function f() { "use strict"; for (d in arguments) { tc = !d; } } typein:1:39 .......................................^ makes perfect sense -- instead of checking for |d| being a valid assignment target, we're mistakenly checking for |arguments| being a valid assignment target. Which, here, it is not (under the code's mistaken understanding). Bug 1235640 fixes this mis-checking, by properly taking advantage of extra integers to represent arguments/eval name nodes, and checking for arguments/eval using those integers, not using the problematic last-atom concept. Patch is up, should be fixed whenever shu gets around to reviewing it.