452298 - "Assertion failure: slot < (uintN) (((jp->fun)->nargs + (jp->fun)->u.i.nvars) + (jp->fun)->u.i.nupvars)"

Status: RESOLVED DUPLICATE of bug 451884

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
0. Run a debug build of Firefox from mozilla-central.
1. Load http://blog.monkeykit.com/2007/10/19/installer-updated-to-v30b-for-iphone/.
2. Open a new window (Cmd+N)
3. Close the new window (Cmd+W)
4. Wait for a GC (2-10 seconds).

Result:
Assertion failure: slot < (uintN) (((jp->fun)->nargs + (jp->fun)->u.i.nvars) + (jp->fun)->u.i.nupvars), at /Users/jruderman/central/js/src/jsopcode.cpp:1184

Comment 1

[Jesse Ruderman]

The bug can also be triggered by loading this URL, which is loaded as an iframe from the URL above.

http://www.yelp.com/blogbadgemap?v=1&userid=UcARdl-68pTn5PNno7ngvQ&width=200&height=328&uicolor=ED5100&textcolor=FFFFFF&type=latest&speed=10

Comment 2

[Jesse Ruderman]

After reducing this a bit, I think it's a dup of bug 451884.  It seems to involve eval, and js_DecompileValueGenerator is on the stack.