The attached testcase shows a TypeError at the bottom using js opt shell on IonMonkey changeset 881c4b8e7404 with --no-jm: /snip RangeError: invalid array length RangeError: invalid array length RangeError: invalid array length RangeError: invalid array length RangeError: invalid array length TypeError: (void 0) is not a function but doesn't when run without --no-jm: /snip RangeError: invalid array length RangeError: invalid array length RangeError: invalid array length RangeError: invalid array length RangeError: invalid array length RangeError: invalid array length mozilla-inbound changeset cb74a377095a does not seem to have this issue. All shells tested on 64-bit, and with --enable-more-deterministic. This is at least a regression for IonMonkey.

The first bad revision is: changeset: https://hg.mozilla.org/projects/ionmonkey/rev/8a2010ae3d08 user: Sean Stangl date: Tue Mar 27 12:20:22 2012 -0700 summary: Bug 735400 - Optimize JSOP_FUNCALL. r=dvander

Kindly disregard the crazy levels of indentation. I'll fix that in a follow-up bug -- that whole file needs cleanup badly.

Comment on attachment 636502 [details] [diff] [review] Inline NewArray only if it won't generate a RangeError. Review of attachment 636502 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/CodeGenerator.cpp @@ +989,5 @@ > Register objReg = ToRegister(lir->output()); > types::TypeObject *typeObj = lir->mir()->type(); > uint32 count = lir->mir()->count(); > > + JS_ASSERT((int32_t)count >= 0); JS_ASSERT(count < JSObject::NELEMENTS_LIMIT)

A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.