Assertion failure: !ret && cx->isExceptionPending(), at js/src/jswrapper.cpp:866
The code containing the assertion was added in:
user: Luke Wagner
date: Tue Oct 04 10:50:25 2011 -0700
summary: Bug 690825 - Add a SecurityWrapper base between JS transparent wrappers and XPConnect security wrappers (r=mrbkap)
Created attachment 570570 [details]
testcase (asserts fatally when loaded)
Created attachment 570571 [details]
Luke, can you look into this? Also, guessing sg:critical here, but I'm happy to downgrade this if it's not that severe.
Ah, the assert is bogus: it asserts that, if we return false, an exception is pending. This is not true if we have arrived without pushing a stack frame (in the testcase: via setTimeout + bound function object) in which case ReportError chooses not to throw but to instead report immediately (leaving no exception pending).
Created attachment 572477 [details] [diff] [review]
Oops, my previous description of the assert ("it asserts that, if we return false, an exception is pending") is wrong; I should have said: "it asserts that we return false AND an exception is pending"). Same conclusion though: bogus assert.