882974 - OdinMonkey: Crash [@ js::AsmJSModule::~AsmJSModule] or Assertion failure: hasScript(), at jsfun.h

Status: RESOLVED DUPLICATE of bug 678037

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

((function(stdlib, foreign) {
  "use asm"
  var ff = foreign.ff
  function f() {
	ff()
  }
  return f
})(this, {
  ff: Date.prototype.toLocaleString
}))

asserts js debug shell on mozilla-inbound changeset 56e47c35233e without any CLI arguments at Assertion failure: hasScript(), at jsfun.h and crashes js opt shell at js::AsmJSModule::~AsmJSModule

This changeset contains the fix for bug 882514. Tested on a 32-bit shell with --enable-threadsafe and --enable-more-deterministic, though I'm not sure if these are needed.

s-s because GC is on the stack.

Comment 1

[Hannes Verschore [:h4writer]]

Regression caused by bug 860838.

Comment 2

[Luke Wagner [:luke]]

And fixed by bug 678037 which causes the same condition to occur not just with natives, but with lazily-compiled scripts.  (Test-case for that is already in the tree)