g = f = x = new ArrayBuffer var eval = this try { g.toSource = (function() { x.byteLength }) eval() } catch (e) {} try { x = [, , , , , , , , , , , 0].slice(6)[5] print(uneval(this)) } catch (e) {} shows the following output in js debug and opt shell on m-c changeset 0bb4773db082 without --ion-eager: ... /snipped for the sake of brevity ... }, version:function version() { [native code] }, wrap:function wrap() { [native code] }, wrapWithProto:function wrapWithProto() { [native code] }, x:0}) but does not show anything with --ion-eager. autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 109238:a85c0f30cdfa user: Jan de Mooij date: Thu Oct 04 13:26:16 2012 +0200 summary: Bug 797185 - Disable DVG stack search when building with --enable-more-deterministic. r=decoder

autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: 118117:86e85b93cad1 user: Jan de Mooij date: Tue Jan 08 19:13:19 2013 +0100 summary: Bug 827659 - Ensure |this| is an object when inlining getter/setter calls. r=bhackett jandem, is this a possible fix?

(In reply to Gary Kwong [:gkw] from comment #1) > jandem, is this a possible fix? Yes. x.byteLength is a getter. First x is an ArrayBuffer, then x becomes 0. Before the fix for bug 827659, this would throw with --ion-eager because we'd call the getter with a primitive value. With the patch for bug 827659, it correctly results in |undefined| without an exception.

Batch edit: Bugs marked status-b2g18: affected after 2/13 branching of v1.0.1 are now also status-b2g18-v1.0.1: affected