635805 - "Assertion failure: fp->isFunctionFrame() && !fp->isEvalFrame()"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

Assertion failure: fp->isFunctionFrame() && !fp->isEvalFrame(), at js/src/jsinterpinlines.h:530

I think this started within the last few hours.  I guess it's a regression from bug 634542.  That patch added a call from RunScript to PutActivationObjects, which is seen in this bug's stack trace.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Luke Wagner [:luke]]

Attachment: fix

Ah, d'oh!  Thanks Jesse.  Bug 635805 is going to make all this explicit PutActivationObjects business unnecessary, but might as well fix the
temporary fix first.

Comment 3

[Luke Wagner [:luke]]

http://hg.mozilla.org/mozilla-central/rev/102927bff6de

Erg, I just realized I forgot the most excellent test case.  I will add that to my follow-up work in bug 635811.

OOC Jesse, have you specifically trained your fuzzers to hammer on this function-in-cleared-global corner case, or did this just naturally occur?

Comment 4

[Mike Beltzner [:beltzner, not reading bugmail]]

(bookkeeping changes)