(function() { for (b = 0; b < 2; b++) { if (b) { ("")(function() {}) } } })() crashes js opt shell on TM tip with -j at js::TraceRecorder::record_JSOP_LAMBDA and asserts js debug shell with -j at Assertion failure: isObject(), at ../jsvalue.h:531 === Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_PROTECTION_FAILURE at address: 0x0000008f 0x00171da3 in js::TraceRecorder::record_JSOP_LAMBDA () (gdb) bt #0 0x00171da3 in js::TraceRecorder::record_JSOP_LAMBDA () #1 0x00174f8f in js::TraceRecorder::monitorRecording () #2 0x0005e98e in js::Interpret () #3 0x0006dd1b in js::Execute () #4 0x00014178 in JS_ExecuteScript () #5 0x0000518c in Process () #6 0x00008a97 in shell () #7 0x00008fb7 in main () (gdb) x/i $eip 0x171da3 <_ZN2js13TraceRecorder18record_JSOP_LAMBDAEv+2819>: testb $0x8,0x3b(%eax) (gdb) x/b $eax 0x54: Cannot access memory at address 0x54

autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 48073:80382d88b92c user: Brendan Eich date: Fri Jul 23 14:41:56 2010 -0700 summary: Arguments.callee.caller does not work in FF 4 under certain circumstances (577648, r=jwalden).

A testcase for this bug was already added in the original bug (bug 582479).