579364 - Crash [@ js::ExecuteFrameGuard::~ExecuteFrameGuard] or "Assertion failure: origin != destination,"

Status: RESOLVED DUPLICATE of bug 579273

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
  __proto__ = evalcx('')
})()
try {
  (function() {
    __defineSetter__("y", function() {})
  })()
} catch(e) {}
y = []

asserts js debug shell on TM tip without -j at Assertion failure: origin != destination, at ../jswrapper.cpp:513 and crashes js opt shell on TM tip without -j at js::ExecuteFrameGuard::~ExecuteFrameGuard

(Pass in as a CLI argument, and also tested on 64-bit Mac thus far)

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x00000001000223ea in js::ExecuteFrameGuard::~ExecuteFrameGuard ()
(gdb) bt
#0  0x00000001000223ea in js::ExecuteFrameGuard::~ExecuteFrameGuard ()
#1  0x000000010010fa7a in js::AutoCompartment::leave ()
#2  0x000000010000da51 in JS_LeaveCrossCompartmentCall ()
#3  0x00000001000072a3 in shell ()
#4  0x0000000100007b61 in main ()
(gdb) x/i $eip
Value can't be converted to integer.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(also occurs on a 32-bit machine)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   47546:9c869e64ee26
user:        Luke Wagner
date:        Wed Jul 14 23:19:36 2010 -0700
summary:     Bug 549143 - fatvals