731745 - "Assertion failure: obj->asCall().maybeStackFrame(),"

Status: RESOLVED DUPLICATE of bug 731724

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function h(s) {
  return eval(s)
}
f = h("(function(){function::arguments=[]})")
for (a in f()) {}

asserts js debug shell on m-c changeset 8ec22af2fe91 without any CLI arguments at Assertion failure: obj->asCall().maybeStackFrame(),

May be related to bug 731724, as these 2 asserts both appeared during reduction and point to the same regressing changeset.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   87904:bd71047c9b4d
user:        Luke Wagner
date:        Tue Feb 07 12:34:29 2012 -0800
summary:     Bug 724790 - get rid of the hasOverriddenArgs funny business (r=waldo)

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/e4x/bug731745.js.