try { verifyprebarriers() Array.buildPar(4, function() {}) Array.buildPar(2, function() {}) } catch (e) {} gcPreserveCode() gcslice(1) Array.buildPar(3, function() {}) crashes js debug shell (tested with a threadsafe deterministic 64-bit debug build) on m-c changeset 1238ef12b996 with --fuzzing-safe --ion-parallel-compile=off --ion-eager at js::gc::Cell::arenaHeader and crashes js opt shell at PushMarkStack My configure options are: (opt shell) CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-gcgenerational --with-ccache --enable-threadsafe <other NSPR options> Debug shell: CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-gcgenerational --with-ccache --enable-threadsafe <other NSPR options>