The following testcase asserts on mozilla-central revision b0d842380959 (run with --ion-eager): version(0); function y() { try { test().split(','); } catch(ex) { } } function test() eval("with({}) let(x=[])(function(){x})()"); y(); y(); y();

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 2c85e4d1d678). JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/36b6a36c00bc parent: 127345:836ed183bb5f parent: 122574:67f2a2816651 user: Jan de Mooij date: Fri Feb 22 13:37:13 2013 +0100 summary: Merge from mozilla-central. Not all ancestors of this changeset have been checked. Use bisect --extend to continue the bisection from the common ancestor, 702d2814efbf. This iteration took 173.074 seconds to run. Oops! We didn't test rev 67f2a2816651, a parent of the blamed revision! Let's do that now. Rev 67f2a2816651: Found cached shell... Testing... [Uninteresting] It didn't crash. (0.447 seconds) good (not interesting) As expected, the parent's label is the opposite of the blamed rev's label. The bug was introduced by a merge (it was not present on either parent). I don't know which patches from each side of the merge contributed to the bug. Sorry.

JSBugMon: Fix Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/f5eca934fa16 user: Jan de Mooij date: Fri Jun 21 08:28:06 2013 +0200 summary: Bug 881902 - Remove ContextStack and StackSpace. r=luke,njn This iteration took 329.705 seconds to run.

Jan, is bug 881902 a possible fix?

(In reply to Gary Kwong [:gkw] [:nth10sd] (yes, still catching up on bugmail) from comment #3) > Jan, is bug 881902 a possible fix? It's possible, bug 881902 was a big rewrite/refactoring. Are the fuzzers still hitting this?

I'm not hitting this anymore, at least nothing in the log for a few days now.

Nope, not seen this recently either.

Assuming FIXED by bug 881902.