I cannot seem reproduce this on Linux using an up-to-date trunk build. Konstantin, what release of SpiderMonkey are you using?
We are using js-1.5-rc6a.
RC6a is quite old. Perhaps someone can suggest a bug that was fixed since then that matches this bug. There will be a JS1.6 RC1 soon, I believe (bclary knows all), but in the mean time you could do worse than to try the MOZILLA_1_8_BRANCH version of js/src. /be
Checking in regress-310295.js; /cvsroot/mozilla/js/tests/js1_5/Regress/regress-310295.js,v <-- regress-310295.js initial revision: 1.1 done works for me in 1.0.7/1.6. I couldn't find any particular bug fixed in the correct date range. Marking works for me.