for (var i = 0; i < 4; ++i) { for (let j = 0; j < 2; ++j) { } let (x) (function(){}); } asserts dbg at Assertion failure: !js_IsActiveWithOrBlock(cx, fp->scopeChain, 0), at ../jsinterp.cpp:7075 while a variant, for (let i = 0; i < 4; ++i) { for (let j = 0; j < 2; ++j) { } let (x) (function(){}); } asserts dbg TM at Assertion failure: !fp->blockChain, at ../jsinterp.cpp:6686 Thanks Jesse for helping to reduce this testcase. Both seem harmless in opt. Nominating due to their simplicity -- they merely involve two nested for loops (besides let/var functions).

Closures, even ones that do not look at upvars, should depend on bug 452498 for now. I will test and update when the patch for that bug is ready. If you see a crash involving scope or block chain reification assertions, it's a candidate. Setting bug 452498 as the blocker means I won't miss it. /be

autoBisect shows both the testcases in comment #0 were fixed by http://hg.mozilla.org/tracemonkey/rev/74416c7004c5 : changeset: 26137:74416c7004c5 user: Jim Blandy date: Mon Mar 16 09:55:06 2009 -0700 summary: Bug 480132: Clone lexical blocks only when needed. r=igor

http://hg.mozilla.org/tracemonkey/rev/1b44c877f838 /cvsroot/mozilla/js/tests/js1_8/regress/regress-472528-01.js,v <-- regress-472528-01.js initial revision: 1.1 /cvsroot/mozilla/js/tests/js1_8/regress/regress-472528-02.js,v <-- regress-472528-02.js initial revision: 1.1

bug 480132 is fixed1.9.1, so this is fixed1.9.1

Verified fixed with testcases in comment 0 with the following debug builds: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090522 Minefield/3.6a1pre ID:20090522133810 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre) Gecko/20090522 Shiretoko/3.5pre ID:20090522153422