for(let a in[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]) for(d in); assert js debug shell on TM changeset 47a4f03b5947 with -j at Assertion failure: cx->enumerators == obj, tested on Windows 7 32-bit js debug shell.
Brian, want to take a look? You are the new master of the enumeration code now :)
47a4f03b5947 needs to be backed out, it turned the tree pretty orange and I'm pretty sure caused this regression. Unfortunately the tree is closed today for releng/IT stuff, and I can't comment in bug 618574 because it's a security bug.
47a4f03b5947 has been backed out. Hopefully/presumably when bug 618754 lands without breakage the program in comment 0 will work; if someone CCs me on bug 618754 I can add a reminder on that bug to check that this program works.
I'm marking this as open to as a reminder to check that this is fixed once bug 618574 (note corrected bug number) relands.
With the thinko fixed in bug 618574, this goes away.