555155 - JM: "Assertion failure: !cx->throwing, at ../methodjit/Stubs.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
  throw (function f(a, b) {
    if (a.h == b) {
      return eval("((function(){return 1})())!=this")
    }
    f(b)
  })([], 0)
})()

asserts js debug shell on JM tip with -m and -j at Assertion failure: !cx->throwing, at ../methodjit/Stubs.cpp:3344

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/caf81279341a

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug555155.js.