648 bytes, text/plain
The following testcase asserts on mozilla-central revision 2255d7d187b2 (run with --no-threads --fuzzing-safe --ion-check-range-analysis): var otherGlobalSameCompartment = newGlobal("same-compartment"); eval = otherGlobalSameCompartment.eval; eval("\ setObjectMetadataCallback(setObjectMetadataCallback);\ var statusitems = ;\ x = 30;\ delete x;\ ");
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/cb3487d8700b user: Nicolas B. Pierron date: Thu Jul 24 04:30:50 2014 -0700 summary: Bug 1039607 - Scalar Replacement support dynamic slots. r=h4writer This iteration took 127.716 seconds to run.
JSBugMon: The testcase found in this bug no longer reproduces (tried revision f578b845c4b8).
JSBugMon: Fix Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/020c6a559e3a user: Brian Hackett date: Sun May 03 08:14:04 2015 -0700 summary: Bug 1146597 - Add unboxed arrays for JSOP_NEWARRAY arrays, and shell option for using them, r=jandem. This iteration took 197.177 seconds to run.
Bug 1157566 is probably a duplicate of this bug, but it has already received some developer attention and is likely more actionable. Marking this bug as a dup of 1157566 instead.