653262 - TI: Assertion failure: isScriptFrame(), at ../jsinterp.h:329

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision 09cce9915b80 (run with -m -n -a),
tested on 64 bit:

const HAVE_TM = 'tracemonkey' in this;
const HOTLOOP = HAVE_TM ? tracemonkey : 8;
with(evalcx(''))(function eval() {}, this.__defineGetter__("x", Function));
var i = 0;
var o;
new(x);



I'm not sure if it's valid due to the evalcx call in there.

Comment 1

[Brian Hackett [Laid off!]]

When invoking a constructor on a dummy frame we would query the current frame's script to check whether to create a unique type object for the result.  Needed a guard to check the frame actually has a script.

http://hg.mozilla.org/projects/jaegermonkey/rev/f85a663ce75a

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug653262.js.