"use strict" function a() { z -= '' } try { new a() } catch(e) { print('' + e) } without -m output: ReferenceError: reference to undefined property "z" with -m output: ReferenceError: z is not defined (occurs on both debug and opt shells on TM changeset 8dc385ffb820)

fuzzing/js-autobisect/autoBisect.py -i -p -a32 ~/Desktop/622271.js ~/fuzzing/jsfunfuzz/compareJIT.py 6 6 ~/fuzzing/js-known/mozilla-central/ The first bad revision is: changeset: 3903088ba08f user: David Anderson date: Wed Sep 29 20:50:29 2010 -0700 summary: Add an IC for GETXPROP (bug 599035, r=sstangl).

See bug 676823.

Looks harmless. In the interpreter: #0 JSContext::setPendingException() at jscntxtinlines.h:414 ... #6 0x0000000100051eb8 in js_ReportValueErrorFlags() at jscntxt.cpp:1112 #7 0x0000000100100316 in js_GetPropertyHelperInline() at jsobj.cpp:5262 #8 0x000000010010057b in js_GetPropertyHelper() at jsobj.cpp:5294 #9 0x00000001000cbeb6 in js::Interpret() at jsinterp.cpp:3518 In the methodjit: #0 JSContext::setPendingException() at jscntxtinlines.h:414 ... #6 0x0000000100052032 in js_ReportIsNotDefined() at jscntxt.cpp:1038 #7 0x00000001002d49bc in js::mjit::ReportAtomNotDefined() at StubCalls-inl.h:70 #8 0x00000001002e7ee2 in ScopeNameCompiler::retrieve() at methodjit/PolyIC.cpp:1526 #9 0x00000001002d4c91 in js::mjit::ic::XName() at methodjit/PolyIC.cpp:1953 #10 0x00000001008db1ee in ?? () Given the amount of code duplication in the methodjit's runtime support, I'd be shocked if we didn't introduce a bug like this every other week.

ReferenceError: reference to undefined property "z" is now the output for interpreter, -m, and -m -n.