for (var aa = 0; aa < 999999; aa++) { try { Function("\ (function() {})([NaN, , 0])\ ")() } catch (e) {}; } crashes js opt shell on m-c changeset cafe909f7e07 with --ion-eager at js::jit::LiveInterval::addRangeAtHead and asserts js debug shell at Assertion failure: false (MOZ_ASSUME_UNREACHABLE(unexpected type)), at jit/Lowering.cpp My configure flags are: (opt) CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --enable-threadsafe <other NSPR options> Debug: CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --enable-threadsafe <other NSPR options> autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/dbeea0e93b56 user: Brian Hackett date: Mon Dec 16 10:53:02 2013 -0800 summary: Bug 785905 - Build Ion MIR graph off thread, r=jandem. Brian, is bug 785905 a likely regressor?

JSBugMon: Cannot process bug: Error: Failed to compile specified revision cafe909f7e07 (maybe try another?)

(In reply to Christian Holler (:decoder) from comment #1) > JSBugMon: Cannot process bug: Error: Failed to compile specified revision > cafe909f7e07 (maybe try another?) Retry with a later revision that fixed non-threadsafe build compilation issues.

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Bug 785905 has been backed out and I can't reproduce this.

Yes, this is likely fixed by the backout, which has also landed in Aurora. autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/8c521a802625 parent: 168757:9e7cf0b1d80c user: Jan de Mooij date: Fri Feb 14 13:17:53 2014 +0100 summary: Backout bug 785905, off-thread IonBuilder. r=jorendorff

JSBugMon: This bug has been automatically verified fixed.