The attached (not-so-reduced) testcase shows the following output on js debug shell on m-c changeset e19d0885977c (https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1368021890/jsshell-mac64.zip) with --no-baseline --ion-parallel-compile=on --thread-count=9 -a --ion-eager: NestTest mismatch resultO: undefined resultD: jsfunfuzz stopping due to finding a bug. w28-reduced.js:52:5 ReferenceError: assignment to undeclared variable x Note the unexpected mismatch error. Without some of the flags, it only shows (expected): w28-reduced.js:52:5 ReferenceError: assignment to undeclared variable x autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 131118:39ff12be624b user: Jan de Mooij date: Tue May 07 16:27:14 2013 +0200 summary: Bug 690446 - Emit *GNAME ops in non-eval strict-mode code. r=bhackett

The isSetName check in visitSetPropertyCacheT did not include JSOP_SETGNAME. The patch fixes it to match the check in visitSetPropertyCacheV. (If isSetName is false, the cache does not check for undeclared vars in strict mode.)