v = 0 for each(let d in [v, v]) { for (a in [(d--), new String]) { print(((function(c) { return (c) })((function() { return (d) })()))) } } outputs $ 28939/js-dbg-tm-intelmac -j js> v = 0 0 js> for each(let d in [v, v]) { for (a in [(d--), new String]) { print(((function(c) { return (c) })((function() { return (d) })()))) } } -1 -1 -1 0 js> in latest debug js shell with -j but outputs $ 28939/js-dbg-tm-intelmac js> v = 0 0 js> for each(let d in [v, v]) { for (a in [(d--), new String]) { print(((function(c) { return (c) })((function() { return (d) })()))) } } -1 -1 -1 -1 js> in latest debug js shell without -j.

Doesn't output that last "0" with -j: 28356 - http://hg.mozilla.org/tracemonkey/rev/d62fa90d2035 Outputs that last "0" with -j: 28939 - http://hg.mozilla.org/tracemonkey/rev/6afc57314e74 No time yet to get a smaller regression window.

This does not seem to affect 1.9.1: $ ./js-dbg-moz191-intelmac -j js> v = 0 for each(let d in [v, v]) { for (a in [(d--), new String]) { print(((function(c) { return (c) })((function() { return (d) })()))) } } 0 js> -1 -1 -1 -1 js> js> js> ^C $ ./js-dbg-moz191-intelmac js> v = 0 for each(let d in [v, v]) { for (a in [(d--), new String]) { print(((function(c) { return (c) })((function() { return (d) })()))) } } 0 js> -1 -1 -1 -1 js> js> js> ^C $

Need to know what broke this in tm/m-c and not merge it to 1.9.1. /be

for each(let d in [0, 0]) { d--; for (i=0; i<4; i++) assertEq(function(){return d;}(), -1); } The first bad revision is: changeset: 28896:a16ed38ff63a user: David Mandelin <dmandelin@mozilla.com> date: Wed Jun 03 11:19:20 2009 -0700 summary: Bug 494269: trace JSOP_LAMBDA_FC, r=brendan,gal Which is weird, because disfile() wants me to believe that "function(){return d;}" is using JSOP_LAMBDA, not JSOP_LAMBDA_FC.

Seems to be WFM on TM branch tm-28982-568959fa4956

Correctness bug, we should probably block on this. But, resolved fixed already.