User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100423 Ubuntu/10.04 (lucid) Firefox/3.6.3 Build Identifier: http://releases.mozilla.org/pub/mozilla.org/firefox/releases/3.6.6/source/firefox-3.6.6.source.tar.bz2 At first I'm sorry, I've got no example where you don't need to login, but maybe my attached gdb session will tell you everything you need. Since my (self-compiled) FF 3.6.6 crashed on Solaris10/SPARC within yahoo's webmail (as soon as one logs in), I created a Debug build and now the following happens: The assertion in mozilla-1.9.2/js/src/jsfun.cpp:2715 fails. Looking at my backtrace in gdb, I assume that the problem is here: mozilla-1.9.2/js/src/jsfun.cpp:2837 Maybe s/JSLOCAL_VAR/JSLOCAL_ARG/ would help? I wonder if this could have to do sth. with my segmentation fault I encounter with the non-debug built. Reproducible: Always Steps to Reproduce: 1. Go to the http://mail.yahoo.com/ 2. Login Actual Results: jsfun.cpp:2715 assertion fails. (gdb) bt #0 0xff1caa58 in _lwp_kill () from /lib/libc.so.1 #1 0xff165a64 in raise () from /lib/libc.so.1 #2 0xff141914 in abort () from /lib/libc.so.1 #3 0xfb4cc92c in JS_Assert (s=0xfb605998 <error reading variable>, file=0xfb604c38 <error reading variable>, ln=2715) at /opt/zmaw/sw/solaris10/ff_build/mozilla-1.9.2/js/src/jsutil.cpp:69 #4 0xfb3dcd10 in HashLocalName (cx=0xf39b3800, map=0xf09e44d0, name=0xfb64b384, localKind=JSLOCAL_VAR, index=13) at /opt/zmaw/sw/solaris10/ff_build/mozilla-1.9.2/js/src/jsfun.cpp:2715 #5 0xfb3dd4bc in js_AddLocal (cx=0xf39b3800, fun=0xef63d770, atom=0xfb64b384, kind=JSLOCAL_VAR) at /opt/zmaw/sw/solaris10/ff_build/mozilla-1.9.2/js/src/jsfun.cpp:2837 #6 0xfb47d280 in FunctionDef (cx=0xf39b3800, ts=0xffbfdcb8, tc=0xffbfd250, lambda=0) (gdb) up 4 #4 0xfb3dcd10 in HashLocalName (cx=0xf39b3800, map=0xf09e44d0, name=0xfb64b384, localKind=JSLOCAL_VAR, index=13) at /opt/zmaw/sw/solaris10/ff_build/mozilla-1.9.2/js/src/jsfun.cpp:2715 2715 JS_ASSERT(entry->localKind == JSLOCAL_ARG && localKind == JSLOCAL_ARG); (gdb) p *entry $10 = {hdr = {keyHash = 2474559385}, name = 0xfb64b384, index = 0, localKind = 1 '<error reading variable>} (gdb) p localKind $11 = JSLOCAL_VAR (gdb) p /x JSLOCAL_ARG $7 = 0x1 (gdb) p /x JSLOCAL_VAR $8 = 0x2

The same is true for a Debug Build on Debian Lenny (x64_86): Assertion failure: entry->localKind == JSLOCAL_ARG && localKind == JSLOCAL_ARG, at /zmaw/sw/sw/lenny-x64/ff_build/mozilla-1.9.2/js/src/jsfun.cpp:2715

dupe of bug 568276 ?

(In reply to comment #2) > dupe of bug 568276 ? If in jsparser.cpp FunctionDef became js::Parser::functionDef in the meanwhile (that is between 3.6.6 release and http://hg.mozilla.org/rev/13b292f9ab79 definitely yes. Even the URL of failure is the same.

K. Thanks!