882843 - Assertion failure: hasScript(), at jsfun.h

Status: RESOLVED DUPLICATE of bug 882514

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
    (function() {
        t
    })()
} catch (e) {}
Array.prototype.sort.call([0, 0], (function(stdlib, foreign, heap) {
    "use asm";
    var NaN = stdlib.NaN;
    var atan2 = stdlib.Math.atan2;
    var ff = foreign.ff;
    var Float64ArrayView = new stdlib.Float64Array(heap);
    function f(d0, d1) {
        d0 = +d0;
        d1 = +d1;
        ((NaN * ((ff(atan2(d1, (Float64ArrayView[1])))))));
    }
    return f
})(this, {
    ff: Date
}, ArrayBuffer(4096)));

asserts js debug shell on m-c changeset b197bed90a98 without any CLI arguments at Assertion failure: hasScript(), at jsfun.h

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/2810e80e1393
user:        Hannes Verschore
date:        Wed Jun 12 21:58:22 2013 +0200
summary:     Bug 860838: OdinMonkey: Optimize FFI calls to ionmonkey, r=luke