The following testcase asserts on mozilla-central revision e162098b76d9 (run with --ion-eager): var SECTION = ""; function TestCase(n, d, e, a) { this.name = n; this.description = d; this.expect = e; !document.location.href.match(/jsreftest.html/) } var lfcode = new Array(); lfcode.push("gcparam(\"maxBytes\", gcparam(\"gcBytes\") + 4*1024);\n"); lfcode.push(" return -((new Date(2000, 1, 1)).getTimezoneOffset())/60;\n"); lfcode.push("\ gczeal(4);\ new TestCase(SECTION, eval(\"Number.prototype.toString()\") );\ "); delete Debugger; while (true) { var file = lfcode.shift(); if (file == undefined) { break; } loadFile(file) } function loadFile(lfVarx) { try { lfVarx.substr(-3) lfRunTypeId = parseInt(lfVarx); switch (lfRunTypeId) { default: function newFunc(x) { new Function(x)(); }; newFunc(lfVarx); break; } } catch (lfVare) { } }

This is an OOM issue, but it seems to cause multiple signatures, including a barrier verifier assert, so it would be good to get this fixed.

JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 119272:7b531a62b114 user: Brian Hackett date: Fri Jan 18 09:23:28 2013 -0700 summary: Bug 772820 - Disallow GCs during script analysis or compilation, r=billm. This iteration took 101.029 seconds to run.

Needinfo on Brian based on comment 2 :)

Blame is wrong, this is a preexisting issue (bug 772820 affects when we OOM).