gczeal(2) x = false; for (let a in [String, 0]) { x function p() { a } } asserts js shell on TM tip without -j at Assertion failure: slot < obj2->scope()->freeslot, at ../jsops.cpp:2198 s-s because this involves gczeal.

autoBisect shows this is probably related to bug 540706: The first bad revision is: changeset: 41905:a00078178698 user: Luke Wagner date: Wed Mar 03 17:52:26 2010 -0800 summary: Bug 540706 - use contiguous buffer for stack frames and slots (r=waldo)

Awesomely short test case; thanks Gary! This seems to be a bug related to bug 540805; bug 540706 just changes the order in which things are marked (and thus the order that shapes are regenerated) in such a way that the bug is exposed. The problem is that emptyBlockScope's shape is not changed on a shape-regenerating GC, and thus some other scope can be given the same shape. This means that a block can get a false hit in the prop-cache for (in this case, the global object). emptyArgumentsScope appears to have the same problem.

Igor, can you verify if this is related to bug 540805?

(In reply to comment #3) > Igor, can you verify if this is related to bug 540805? Yes, this is indeed a regression from that bug.

The patch reserves the shapes for empty arguments and block objects so they are never reused.

The new patch removes unreleated changes and whitespace junk from v1.

Brute force, more than ok for now. I think shapes as generated uint32 (uint24) value capabitilies go away at the end of the patch queue for bug 558451. /be