Created attachment 549740 [details]
x.(-0 in x)
asserts js debug shell on MI changeset b4165ae3685f without any CLI arguments at Assertion failure: js_CheckForStringIndex(id) == id,
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
user: Jason Orendorff
date: Wed Jul 27 17:44:29 2011 -0500
summary: Bug 651940 - When hashing a jsid, assert that js_CheckForStringIndex(id) == id. r=Waldo.
This invariant is old. Only the assertion is new in that revision.
This is probably a very old bug. Removing the bugzilla dependency.
Looking into it.
Created attachment 550568 [details] [diff] [review]
Here E4X is using a function whose only other caller is JS_Alias*. Whee.
A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-675581.js.
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.