Patch coming.
Created attachment 25663 [details] patch Haven't run SunSpider yet.
Comment on attachment 25663 [details] patch r=me. Very nice cleanup!
Blergh. Crashes on SunSpider in release builds only. Here's a reduction: (function () { for ( ; false; ) { for ( ; false; ) { } continue; } })();
Crashes beneath BytecodeGenerator::continueTarget when calling SegmentedVector::removeLast.
Turns out the crash was due to out-of-date object files. Clean build fixed it.
Committed revision 38925.