Both http://jsastar.tapirpirates.net/original_tracemonkeybench/JSAStarBenchmark.html and http://jsastar.tapirpirates.net/dfdemo/JSAStarBenchmark.html fail to actually produce correct output in an optimized moo-branch browser. I tried running a debug moo branch browser too, but it more or less hangs under js::BytecodeAnalyzer::analyze (doing lots of work for tens of seconds; I killed it).

BytecodeAnalyzer compares its results with those of the decompiler analysis after every JSOp. Disabling that check would most likely avoid the hang.

Reproduced. Getting a shell test case.

Still reducing, but I see what's going wrong. There are two local variables being tracked and both have the same register pair.

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/712b3f2d358b Ended up being a simple bug in new() when the scripted ctor could not be compiled.