function f(x) { x["__proto__"] } for each(a in [{}, null]) { try { f(a) } catch (e) { print(e) } } on 64-bit js shell on m-c changeset 58f3ccaa02b8, without --ion-eager shows: TypeError: null has no properties but with --ion-eager shows: TypeError: anonymous method called on incompatible null (not sure if this is correct:) autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 106565:adb60cc7b150 parent: 106564:5d1128ed64af parent: 99642:9b876829ed32 user: David Anderson date: Wed Jul 18 19:02:32 2012 -0700 summary: Merge from mozilla-central.

The result without --ion-eager is correct: trying to get a property off of |null| shouldn't work. It looks like in the latter case something's caching the __proto__ getter function (which is a JSNative-backed function) and calling that with |null| as |this|, rather than throwing before it even attempts to find the property at all, let alone call the function.

dvander, does the regression window seem plausible? Moreover, comment 1 seems to indicate that this is an Ion bug.

(In reply to Gary Kwong [:gkw, :nth10sd] from comment #2) > dvander, does the regression window seem plausible? > > Moreover, comment 1 seems to indicate that this is an Ion bug. If it's an early Ion bug, there's probably not a terribly useful regression range, since stuff wasn't really stable for a long time.

Duping forward, that bug has a patch.