Created attachment 614928 [details]
asserts js debug shell on IonMonkey changeset e78cfa69741e without any CLI arguments at Assertion failure: isInterpreted(),
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
user: Nicolas Pierron
date: Fri Mar 23 20:30:57 2012 -0700
summary: Rewrite fun_getProperty to handle Ion Frames (Bug 732853 part 2, r=dvander)
Created attachment 614933 [details]
stack on mozilla-inbound rev 662c163ac088
Crashes at js::StackFrame::isNonEvalFunctionFrame on mozilla-inbound rev 662c163ac088 instead.
Created attachment 614935 [details]
Opt shell stack on mozilla-inbound rev 662c163ac088
Crashes opt shell at js::ArgumentsObject::createUnexpected too. Seems to be a null deref.
The mozilla-inbound regression is likely to be bug 744670.
Created attachment 614957 [details] [diff] [review]
Native calls are not function frames.
This bug should not be closed because it also affects IonMonkey. (see title & whiteboard)
Thanks for your concern.
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 0e6d579045c8).
(In reply to Christian Holler (:decoder) from comment #8)
> JSBugMon: The testcase found in this bug no longer reproduces (tried
> revision 0e6d579045c8).
The bug has been correctly merged, thanks for monitoring.
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug745360.js.