asserts js debug shell on m-c changeset c61e7c3a232a without any CLI arguments at Assertion failure: thing->compartment()->rt == trc->runtime,
I used https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx-debug/1334608993/jsshell-mac.zip
(I couldn't seem to reproduce with a shell compiled locally)
s-s because gc is involved. I'm not sure if the Worker() function is shell-only. If it is, this bug can be opened.
Steve mentions that the Worker() function is enabled with --enable-threadsafe. I don't compile my shells with --enable-threadsafe by default.
Should the tinderboxen js shells be compiled with --enabled-threadsafe by default?
See bug 731448 comment 4. jorendorff mentions that probably "jsworkers.cpp is just completely broken and nobody noticed".
Worker() exists in Gecko ("Error: Constructor requires at least one argument") but I don't know if it's the same underlying worker or not. Should try this using the fuzzing add-on that enables gc() in Firefox.
This does not crash the browser:
It's not the same Worker implementation at all. This is a bug in code that is not linked into Gecko at all.
Unhiding per comment 5.
jsfunfuzz is now running on releng hardware, this assert is clouding results as creating an exception for this assert also ignores other non-Worker triggered testcases for this assert.
I turned off fuzzing of shell Worker, so now we're back where we were before.
(actually, FIXED by the removal of Worker, a known patch in bug 771281 - hurray!)