662562 - TI: crash [@js::analyze::UntrapOpcode::UntrapOpcode]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f(o) {
    o.watch("x", this);
}
var c = evalcx("");
f(c);
--
Crashes 32-bit shell with -n, revision 877522d92ad4.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I have identical crashes on debug/opt Linux/Mac 32/64-bit shells as well.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   70389:51de14efb83c
user:        Brian Hackett
date:        Sun Jun 05 22:39:45 2011 -0700
summary:     [INFER] Apply stack review comments, bug 657412.

Comment 2

[Brian Hackett [Laid off!]]

The new cx->stack.currentScript() function did not compute the topmost script's pc correctly when cx->fp() is a dummy frame.

http://hg.mozilla.org/projects/jaegermonkey/rev/afe33041f481