Bug 678211 - Assertion failure: isScriptFrame(), at ../vm/Stack.h:538 with dummy frame. r=dvander.
authorJason Orendorff <jorendorff@mozilla.com>
Fri, 12 Aug 2011 06:35:37 -0500
changeset 74342 d71ffe484d24f9e84d57e9df16cf779c7aa7470b
parent 74341 78dea7cd0f4daaa29e5f8cc0e556d2ce1a990d1b
child 74343 6fd7a1b9ef64f8d358abb57f9b89b46832fda8c5
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewersdvander
bugs678211
milestone8.0a1
Bug 678211 - Assertion failure: isScriptFrame(), at ../vm/Stack.h:538 with dummy frame. r=dvander.
js/src/jit-test/tests/basic/bug678211.js
js/src/jstracer.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug678211.js
@@ -0,0 +1,3 @@
+var g = newGlobal('new-compartment');
+g.eval("function f(n) { for (var i = 0; i < n; i++) f(0); }");
+g.f(RUNLOOP + 1);
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -10462,17 +10462,20 @@ TraceRecorder::record_EnterFrame()
 
         setFrameObjPtr(fp->addressOfScopeChain(), call_ins);
     } else {
         setFrameObjPtr(fp->addressOfScopeChain(), scopeChain_ins);
     }
 
     /* Try inlining one level in case this recursion doesn't go too deep. */
     if (fp->script() == fp->prev()->script() &&
-        fp->prev()->prev() && fp->prev()->prev()->script() == fp->script()) {
+        fp->prev()->prev() &&
+        fp->prev()->prev()->isScriptFrame() &&
+        fp->prev()->prev()->script() == fp->script())
+    {
         RETURN_STOP_A("recursion started inlining");
     }
 
     return ARECORD_CONTINUE;
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_LeaveFrame()