This assert is triggered by Mochitest-4 layout/style/test/test_bug302186.html, on this line: -- var _46f = MochiKit.Style.computedStyle.apply(d, arguments); -- (gdb) call js_DumpPC(cx) main: 00042:4182 trace 0 00045:4183 getgname "MochiKit" 00048:4183 getprop "Style" 00051:4183 getprop "computedStyle" 00054:4183 callprop "apply" 00057:4183 getlocal 0 00060:4183 arguments --> 00061:4183 funapply 2 00064:4183 setlocal 2

The crash here is in the SSA analysis while compiling the function invoked by the apply. For switch and try blocks we didn't propagate stack values to the possible branch targets, which manifested in the assert fixed in bug 652314. That fix was a workaround, and insufficient to address the base problem of not knowing the stack at these targets --- if the only path to an exception handler occurs if an exception was actually thrown, we had no stack info at the handler's PC. This fix removes the workaround and propagates the stack for switch and try blocks. http://hg.mozilla.org/projects/jaegermonkey/rev/e5068d17c8e3