570746 - Assertion failure: rt->emptyArgumentsScope->shape == JSScope::EMPTY_ARGUMENTS_SHAPE, at js/src/jsscope.cpp:289

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

This happens during browser startup. I think I know what the problem is. Patch with jsapi-test coming.

Comment 1

[Jason Orendorff [:jorendorff]]

BEGIN_TEST(testContexts_bug570764)
{
    JSRuntime *rt2 = JS_NewRuntime(8L * 1024 * 1024);
    CHECK(rt2);

    // Create and destroy first context.
    JSContext *cx2 = JS_NewContext(rt2, 8192);
    CHECK(cx2);
    JS_BeginRequest(cx2);
    JSObject *obj = JS_NewGlobalObject(cx2, getGlobalClass());
    CHECK(obj);
    jsvalRoot objr(cx2, OBJECT_TO_JSVAL(obj));
    JS_DestroyContext(cx2);

    // Create and destroy second context.
    cx2 = JS_NewContext(rt2, 8192);
    CHECK(cx2);
    JS_DestroyContext(cx2);

    JS_DestroyRuntime(rt2);
}
END_TEST(testContexts_bug570764)

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 3

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/d12f72c640fe

Comment 4

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/d12f72c640fe