The following test asserts on jaegermonkey revision ff51ddfdf5d1 (options -m -n): function makeGenerator() { yield function generatorClosure() {}; } var generator = makeGenerator(); findReferences(generator);

Related to bug 698074 ? (The testcase there doesn't involve yield)

This has the same regressing changeset as bug 698074, so fwiw, that bug might just be a dupe of this one. The flags (-m -n) specified in comment 0 weren't needed either. autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 77570:ff51ddfdf5d1 user: Brian Hackett date: Wed Sep 28 15:04:55 2011 -0700 summary: Remove shape numbers and Shape::slotSpan, factor Shape getter/setter into BaseShape, bug 684505.

As per decoder's request, this does not reproduce on m-c changeset 1c7e1db3645b.

Use of shape->slot() instead of shape->maybeSlot() in some debugging code called under findReferences. https://hg.mozilla.org/projects/jaegermonkey/rev/e414b516fd92

Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929