When a FAIL_JSVAL builtin throws an exception, the side exit by design sets regs->pc to point to the next op after the JSOP_CALL. This behavior is necessary when the call succeeds but the return value mismatches, but it has always been a bug that we advance pc on error. The interpreter doesn't. Bug 462027 replaces FAIL_JSVAL with FAIL_STATUS but does not fix this bug. Bug 468472 comment 20 mentions an assertion in jsinterp.cpp's error handler that is a symptom of this bug.

(In reply to comment #0) > Bug 468472 comment 20 mentions an assertion in jsinterp.cpp's error handler > that is a symptom of this bug. Bug 468782 comment 20, I think. /be

Also caused 484628.

Should this block? /be

Obsolete with the removal of tracejit.