Assertion failure: !ret && cx->isExceptionPending(), at js/src/jswrapper.cpp:866 The code containing the assertion was added in: changeset: 949c2cf4c772 user: Luke Wagner date: Tue Oct 04 10:50:25 2011 -0700 summary: Bug 690825 - Add a SecurityWrapper base between JS transparent wrappers and XPConnect security wrappers (r=mrbkap)
Luke, can you look into this? Also, guessing sg:critical here, but I'm happy to downgrade this if it's not that severe.
Ah, the assert is bogus: it asserts that, if we return false, an exception is pending. This is not true if we have arrived without pushing a stack frame (in the testcase: via setTimeout + bound function object) in which case ReportError chooses not to throw but to instead report immediately (leaving no exception pending).
Created attachment 572477 [details] [diff] [review] rm assert Oops, my previous description of the assert ("it asserts that, if we return false, an exception is pending") is wrong; I should have said: "it asserts that we return false AND an exception is pending"). Same conclusion though: bogus assert.