uneval(Function("function r([],x){this.b=function(){x}}")) asserts js debug shell on TM tip without -j at Assertion failure: *pc == JSOP_GETARG, at ../jsopcode.cpp:4990 autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 37037:36bbd730e24f user: Brendan Eich date: Thu Jan 14 09:33:14 2010 -0800 summary: Analyze module pattern and private-statics pattern in order to despecialize from methods to slots/sprops (536564, r=jorendorff).

The value of *pc is JSOP_UNBRANDTHIS instead of the expected JSOP_GETARG.

still asserts

Explanation in comment.

Comment on attachment 498151 [details] [diff] [review] fix >+ * The decompiler has assumptions about what may occur immediately after >+ * script->main (e.g., in the case of destructured args). Thus, put the >+ * following ops into the range [script->code, script->main). Note: >+ * execution starts from script->code, so this has no semantic effect. ..12345678901234567890123456789012345678901234567890123456789012345678901234567890 Nit: "destructuring params" is better and won't rewrap, so use that. Thanks, /be

Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929