an assert I encountered today

gistfile1.txt

FILE: liquid-resize-norrowed.js

// -*- mode: js2; indent-tabs-mode: nil; -*-

var baz = new Array(100);
function F() { }
baz.__proto__ = new F(); // <-- need this to expose issue

for (var i=0; i < 99; i++) {
//              ^-- this threshold needs to be high to expose issue

  new ParallelArray([1,1], function (i,j) baz[i], undefined);
}


The assert fail:
% ../../../objdir-dbg-js/js liquid-resize-narrowed.js
Assertion failure: scope->asCall().callee().nonLazyScript() == i.funScript(), at /Users/fklock/Dev/Mozilla/iontrail/js/src/vm/Stack.cpp:263
Segmentation fault: 11

The backtrace under gdb:

(gdb) r liquid-resize-narrowed.js
Starting program: /Users/fklock/Dev/Mozilla/iontrail/objdir-dbg-js/js liquid-resize-narrowed.js
Reading symbols for shared libraries ++++++++.............................................................. done
Assertion failure: scope->asCall().callee().nonLazyScript() == i.funScript(), at /Users/fklock/Dev/Mozilla/iontrail/js/src/vm/Stack.cpp:263

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
AssertDynamicScopeMatchesStaticScope (cx=0x102100cb0, script=0x10312ca00, scope=0x103157e80) at /Users/fklock/Dev/Mozilla/iontrail/js/src/vm/Stack.cpp:263
(gdb) bt
#0  AssertDynamicScopeMatchesStaticScope (cx=0x102100cb0, script=0x10312ca00, scope=0x103157e80) at /Users/fklock/Dev/Mozilla/iontrail/js/src/vm/Stack.cpp:263
#1  0x00000001005e6c58 in js::StackFrame::prologue (this=0x1022002e0, cx=0x102100cb0, newType=false) at /Users/fklock/Dev/Mozilla/iontrail/js/src/vm/Stack.cpp:317
#2  0x000000010026d2ad in js::Interpret (cx=0x102100cb0, entryFrame=0x1022002e0, interpMode=js::JSINTERP_NORMAL) at /Users/fklock/Dev/Mozilla/iontrail/js/src/jsinterp.cpp:1161
#3  0x000000010026c7ad in js::RunScript (cx=0x102100cb0, fp=0x1022002e0) at /Users/fklock/Dev/Mozilla/iontrail/js/src/jsinterp.cpp:325
#4  0x0000000100297dcf in js::InvokeKernel (cx=0x102100cb0, args={<JS::CallReceiver> = {usedRval_ = false, argv_ = 0x1022002c8}, argc_ = 3}, construct=js::NO_CONSTRUCT) at /Users/fklock/Dev/Mozilla/iontrail/js/src/jsinterp.cpp:382
#5  0x00000001001081a3 in js::Invoke (cx=0x102100cb0, args=@0x7fff5fbf2fa8, construct=js::NO_CONSTRUCT) at jsinterp.h:135
#6  0x0000000100108093 in js::FastInvokeGuard::invoke (this=0x7fff5fbf2fa8, cx=0x102100cb0) at jsinterpinlines.h:1172
#7  0x0000000100641485 in ParallelDo::executeSequentially (this=0x7fff5fbf3358) at /Users/fklock/Dev/Mozilla/iontrail/js/src/vm/ParallelDo.cpp:570
#8  0x0000000100640de0 in ParallelDo::warmupForParallelExecution (this=0x7fff5fbf3358) at /Users/fklock/Dev/Mozilla/iontrail/js/src/vm/ParallelDo.cpp:554
#9  0x000000010063e3a1 in ParallelDo::apply (this=0x7fff5fbf3358) at /Users/fklock/Dev/Mozilla/iontrail/js/src/vm/ParallelDo.cpp:466
#10 0x000000010063cb5d in js::parallel::Do (cx=0x102100cb0, args=@0x7fff5fbf3600) at /Users/fklock/Dev/Mozilla/iontrail/js/src/vm/ParallelDo.cpp:649
#11 0x0000000100696cfd in intrinsic_ParallelDo (cx=0x102100cb0, argc=2, vp=0x102200298) at /Users/fklock/Dev/Mozilla/iontrail/js/src/vm/SelfHosting.cpp:247
#12 0x00000001020e2ec0 in ?? ()
#13 0x000000010072b03a in js::mjit::EnterMethodJIT (cx=0x102100cb0, fp=0x1022000f0, code=0x1020c63a0, stackLimit=0x1025e0000, partial=false) at /Users/fklock/Dev/Mozilla/iontrail/js/src/methodjit/MethodJIT.cpp:1042
#14 0x000000010072b59d in CheckStackAndEnterMethodJIT (cx=0x102100cb0, fp=0x1022000f0, code=0x1020c63a0, partial=false) at /Users/fklock/Dev/Mozilla/iontrail/js/src/methodjit/MethodJIT.cpp:1100
#15 0x000000010072b3c2 in js::mjit::JaegerShot (cx=0x102100cb0, partial=false) at /Users/fklock/Dev/Mozilla/iontrail/js/src/methodjit/MethodJIT.cpp:1118
#16 0x000000010026c783 in js::RunScript (cx=0x102100cb0, fp=0x1022000f0) at /Users/fklock/Dev/Mozilla/iontrail/js/src/jsinterp.cpp:322
#17 0x0000000100297dcf in js::InvokeKernel (cx=0x102100cb0, args={<JS::CallReceiver> = {usedRval_ = false, argv_ = 0x1022000d8}, argc_ = 3}, construct=js::NO_CONSTRUCT) at /Users/fklock/Dev/Mozilla/iontrail/js/src/jsinterp.cpp:382
#18 0x00000001001081a3 in js::Invoke (cx=0x102100cb0, args=@0x7fff5fbf3ed0, construct=js::NO_CONSTRUCT) at jsinterp.h:135
#19 0x000000010064350a in js::ParallelArrayObject::constructHelper (cx=0x102100cb0, ctor={<js::MutableHandleBase<JSFunction *>> = {<No data fields>}, ptr = 0x7fff5fbf4010}, args0=@0x7fff5fbf3fe8) at /Users/fklock/Dev/Mozilla/iontrail/js/src/builtin/ParallelArray.cpp:186
#20 0x0000000100642dc4 in js::ParallelArrayObject::construct (cx=0x102100cb0, argc=3, vp=0x1022000a0) at /Users/fklock/Dev/Mozilla/iontrail/js/src/builtin/ParallelArray.cpp:107
#21 0x00000001020e2b4b in ?? ()
#22 0x000000010072b03a in js::mjit::EnterMethodJIT (cx=0x102100cb0, fp=0x102200038, code=0x1020e055d, stackLimit=0x1025e0000, partial=true) at /Users/fklock/Dev/Mozilla/iontrail/js/src/methodjit/MethodJIT.cpp:1042
#23 0x000000010072b59d in CheckStackAndEnterMethodJIT (cx=0x102100cb0, fp=0x102200038, code=0x1020e055d, partial=true) at /Users/fklock/Dev/Mozilla/iontrail/js/src/methodjit/MethodJIT.cpp:1100
#24 0x000000010072b5f4 in js::mjit::JaegerShotAtSafePoint (cx=0x102100cb0, safePoint=0x1020e055d, partial=true) at /Users/fklock/Dev/Mozilla/iontrail/js/src/methodjit/MethodJIT.cpp:1130
#25 0x000000010026e302 in js::Interpret (cx=0x102100cb0, entryFrame=0x102200038, interpMode=js::JSINTERP_NORMAL) at /Users/fklock/Dev/Mozilla/iontrail/js/src/jsinterp.cpp:1374
#26 0x000000010026c7ad in js::RunScript (cx=0x102100cb0, fp=0x102200038) at /Users/fklock/Dev/Mozilla/iontrail/js/src/jsinterp.cpp:325
#27 0x000000010029a7a3 in js::ExecuteKernel (cx=0x102100cb0, script={<js::HandleBase<JSScript *>> = {<No data fields>}, ptr = 0x7fff5fbff260}, scopeChain=@0x103128060, thisv=@0x7fff5fbff100, type=js::EXECUTE_GLOBAL, evalInFrame={ptr_ = 0}, result=0x0) at /Users/fklock/Dev/Mozilla/iontrail/js/src/jsinterp.cpp:513
#28 0x000000010029ab30 in js::Execute (cx=0x102100cb0, script={<js::HandleBase<JSScript *>> = {<No data fields>}, ptr = 0x7fff5fbff260}, scopeChainArg=@0x103128060, rval=0x0) at /Users/fklock/Dev/Mozilla/iontrail/js/src/jsinterp.cpp:552
#29 0x00000001000b4d94 in JS_ExecuteScript (cx=0x102100cb0, objArg=0x103128060, scriptArg=0x10312c100, rval=0x0) at /Users/fklock/Dev/Mozilla/iontrail/js/src/jsapi.cpp:5510
#30 0x0000000100004c3c in Process (cx=0x102100cb0, obj_=0x103128060, filename=0x7fff5fbffb4c "liquid-resize-narrowed.js", forceTTY=false) at /Users/fklock/Dev/Mozilla/iontrail/js/src/shell/js.cpp:595
#31 0x0000000100002c07 in ProcessArgs (cx=0x102100cb0, obj_=0x103128060, op=0x7fff5fbff898) at /Users/fklock/Dev/Mozilla/iontrail/js/src/shell/js.cpp:5126
#32 0x0000000100001909 in Shell (cx=0x102100cb0, op=0x7fff5fbff898, envp=0x7fff5fbff9d0) at /Users/fklock/Dev/Mozilla/iontrail/js/src/shell/js.cpp:5163
#33 0x00000001000036fd in main (argc=2, argv=0x7fff5fbff9b8, envp=0x7fff5fbff9d0) at /Users/fklock/Dev/Mozilla/iontrail/js/src/shell/js.cpp:5382
(gdb)