Created attachment 549740 [details] stack x=<x/> x.(-0 in x) asserts js debug shell on MI changeset b4165ae3685f without any CLI arguments at Assertion failure: js_CheckForStringIndex(id) == id, autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 73438:cad13a541e30 user: Jason Orendorff date: Wed Jul 27 17:44:29 2011 -0500 summary: Bug 651940 - When hashing a jsid, assert that js_CheckForStringIndex(id) == id. r=Waldo.
This invariant is old. Only the assertion is new in that revision. This is probably a very old bug. Removing the bugzilla dependency. Looking into it.
Created attachment 550568 [details] [diff] [review] v1 Here E4X is using a function whose only other caller is JS_Alias*. Whee.
A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-675581.js.
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.