(function() { eval("\ for (var x = 0; x < 2; x++) {\ if (x) {} else {}\ }\ "); })() asserts js debug shell with -j on TM tip at Assertion failure: sprop->flags & SPROP_HAS_SHORTID, at ../jstracer.cpp:8008 autoBisect shows this is probably related to bug 530255: The first bad revision is: changeset: 35378:17bd8551d437 user: Boris Zbarsky date: Thu Dec 03 23:03:46 2009 -0500 summary: Bug 530255. Replace GetFromClosure/GetClosureVar/GetClosureArg with hand-crafted LIR in the common easycase of a Call object whose frame is no longer active at record time, and make GetFromClosure use a direct read from the object's dslots if we discover that the frame became inactive between record and trace. r=dmandelin,brendan

This was filed and fixed already, bug 532847. /be

Duping then, thanks for the note. I had did a search for the assertion message and nothing had come up. :(