Created attachment 631509 [details] Testcase for shell The attached testcase asserts on ionmonkey revision 5cfb73435e06 (run with --ion -n -m --ion-eager).
Created attachment 631538 [details] [diff] [review] patch IGC started after the toggledJump was emitted. Fix is to always emit barriers as disabled, then enable at the very end of compilation. Further GC action will then correctly toggle the script's barriers, since it will be reachable from a JSScript.
Forgot to update a header for ARM. http://hg.mozilla.org/projects/ionmonkey/rev/ea534d594d01
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/2e891e0db397