1162413 - Relazification can cause CloneFunctionObject to assert

Status: RESOLVED DUPLICATE of bug 1161968

(Core :: JavaScript Engine, defect)

Description

[Shu-yu Guo [:shu]]

There's a check in CloneFunctionObject that instantiates an AutoDelazify |if (!useSameScript && fun->isInterpretedLazy())|.

The problem is that a GC could cause |fun| to be relazified, so we need to instantiate the AutoDelazify whenever !useSameScript, regardless of fun->isInterpretedLazy.

Comment 1

[Shu-yu Guo [:shu]]

Attachment: AutoDelazify when not reusing the script in CloneFunctionObject.

Comment 3

[Jan de Mooij [:jandem]]

Comment on attachment 8602563 [details] [diff] [review]
AutoDelazify when not reusing the script in CloneFunctionObject.

Review of attachment 8602563 [details] [diff] [review]:
-----------------------------------------------------------------

Makes sense.