for (var j = 0; j < 9999; ++j) { (function() { Math.pow(Math.fround(), Math.fround(0)) })(); } asserts js debug shell on m-c changeset 7010ab83a06e without any CLI arguments at Assertion failure: specialization_ == MIRType_Int32 || specialization_ == MIRType_Double, at jit/TypePolicy.cpp This is occurring very often, setting [fuzzblocker]. My configure flags are: CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --disable-threadsafe === Tinderbox Build Bisection Results by autoBisect === The "good" changeset has the timestamp "20140220095927" and the hash "25168278f39a". The "bad" changeset has the timestamp "20140220102129" and the hash "7a5cbe4dadf8". Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=25168278f39a&tochange=7a5cbe4dadf8 Bug 930477 is the only bug in the regression window, setting needinfo? from Benjamin.

Thanks for the report! It was also the cause of the massive regression in Octane-mandreel on AWFY. Fixed in bug 930477 (I've added your test case there).