x = new Uint8Array(ArrayBuffer(36), 18); var y = []; for (var z = 0; z < 99; z++) { Array.prototype.unshift.call(y, x); }; Array.prototype.sort.call(y, Array.indexOf.bind()); asserts the following js debug shell on m-c changeset 0888e29c83a3 without any CLI arguments at Assertion failure: a.isGeneralReg(), at ion/shared/CodeGenerator-shared-inl.h https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-win32-debug/1374007345/jsshell-win32.zip I can't reproduce the original unreduced testcase on Mac yet, so I don't know how bad this is. Will attempt to run autoBisect.

Likely a dup of bug 893732.

(In reply to Christian Holler (:decoder) from comment #1) > Likely a dup of bug 893732. Hmm, you're likely right. I wonder why bugzilla's dupe bug search didn't cause that bug to show up. autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/0670cdaf7e9c user: Brian Hackett date: Thu Jul 11 15:08:26 2013 -0600 summary: Bug 891400 - Improve pattern matching on static typed array accesses, r=jandem. Brian, perhaps you could open this one up if it isn't s-s.

Likely not s-s because bug 893732 isn't s-s, so opening up.