This problem is seen in the JavaScriptCore regression test js1_5/Regress/regress-118849.js. There is only one easy way of fixing this, adding an exception check to op_construct, so hopefully that doesn't regress performance.
Created attachment 20808 [details] Proposed patch Here's the natural patch. It fixes the test, and is either a slight speedup on SunSpider or no regression.
Comment on attachment 20808 [details] Proposed patch r=me
Created attachment 20809 [details] Revised proposed patch We should do the exception check before writing to any register. The code currently doing the check after writing is incorrect. This version does slightly better on SunSpider, for a pretty definite 0.4% progression.
Comment on attachment 20809 [details] Revised proposed patch r=me
Landed r 32538