879132 - Crash [@ js::EncapsulatedPtr] or Assertion failure: isInterpreted(), at jsfun.h

Status: RESOLVED DUPLICATE of bug 878520

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug and opt stacks

(function h() {
    function x() {
        r(function() {
            "use asm";
            function f(i0, d1) {
                i0 = i0 | 0;
                d1 = +d1;
            }
            return f
        })
    }
    h()
})()

asserts js debug shell on m-c changeset 57d30169ddd4 without any CLI arguments at Assertion failure: isInterpreted(), at jsfun.h and crashes js opt shell at js::EncapsulatedPtr

Locking s-s in case this is sensitive in any way.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Erm, this looks similar to bug 878520, but the testcase here crashes opt.

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Actually, bug 878520 crashes also opt builds, and as the patch proposed in the latter solves also this problem, we can consider it as a duplicate.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Opening up since bug 878520 is open.