a = b = c = d = [] e = f = g = h = i = j = k = a[6] = {} function x() {} v = [] for (var p in this) { Array.prototype.some.call(a, (function() { y = Uint8ClampedArray.z })) } asserts js debug shell on m-c changeset 36da3cb92193 without any CLI arguments at Assertion failure: hasScript(), at jsfun.h autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/ce43d28276e4 user: Brian Hackett date: Fri Jun 14 05:58:28 2013 -0600 summary: Bug 678037 - Enable lazy JS parsing and fix various bugs, r=waldo,evilpie,nobody.

When iterating over inlined Ion frames, the callee function may be lazily interpreted. The script will exist, and the function just needs to be repointed to it. This patch also cleans up some metastasis in the methods for getting scripts off functions, and adds a comment on how to use the remaining methods.

Pushing ahead of review to hopefully fix bug 883560. https://hg.mozilla.org/integration/mozilla-inbound/rev/91f620586eb8

Comment on attachment 763237 [details] [diff] [review] patch Review of attachment 763237 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/jsfun.h @@ +242,5 @@ > JS_ASSERT(hasScript()); > return u.i.s.script_; > } > > + inline JSScript *getExistingScript(); The usual naming convention is that "getX" means that the operation is fallible. This one isn't, so could you name it "existingScript()"?

(In reply to Luke Wagner [:luke] from comment #4) > The usual naming convention is that "getX" means that the operation is > fallible. This one isn't, so could you name it "existingScript()"? Setting needinfo so this todo doesn't get lost.

The function was renamed separately.