gczeal(8, 1) function f() { (function() {})() } function g(x) { if (!x) { x = "" } f(x.length) } g() g(0) asserts 32-bit js debug shell on m-c changeset 204de5b7e0a6 with --ion-eager --ion-regalloc=backtracking at Assertion failure: v->toGCThing(), at gc/Marking.cpp (pass in the testcase as a CLI argument) Setting needinfo from Brian as this involves --ion-regalloc=backtracking, thanks to Jesse for helping to reduce this.

autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/2ae7acc7c485 user: Brian Hackett date: Tue May 28 07:00:55 2013 -0600 summary: Bug 875276 - Improve robustness when optimizing .length accesses on objects, r=jandem.

autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/1684c32be328 user: Kannan Vijayan date: Tue Jun 11 15:49:51 2013 -0400 summary: Bug 859609 - Inline functions that use the scope chain, and also inline call sites with monomorphic cloned lambdas. r=h4writer Kannan, is bug 859609 a possible fix?

No, it's highly unlikely that bug 859609 is a fix for this. I think it's a fluke.

A newer testcase has been found in bug 906858, so marking this as WFM for now.