./js -j a.js Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:944) a.js: var a = [0,1,2,3,4,5]; for (let f in a); [(function(){})() for each (x in a) if (x)]; Gary found this with jsfunfuzz, and I helped reduce it. Only crashes when the file is given on the command line, not when its contents are pasted into the interactive shell. The same assertion happens in bug 463782, but I doubt that site uses array comprehensions, so I'm filing this separately. It's important that the first item in the array is zero. I'm guessing that's because it affects the "if (x)" thing.

WFM on tracemonkey 62c408f40d3c, waiting on my m-c pull to finish so I can test there.

Still fails on m-c, so it needs the merge.

No longer asserts on mozilla-central, thanks to today's merge from tracemonkey.

WFM on 1.9.1 as well (even though tracemonkey-62c408f40d3c didn't make it there, must have been a different fix).

http://hg.mozilla.org/mozilla-central/rev/35ae056cf2f1 /cvsroot/mozilla/js/tests/js1_8/regress/regress-463783.js,v <-- regress-463783.js initial revision: 1.1

v 1.9.1, 1.9.2