Comment 85 for bug 908508

The failure in comment #72:

Program received signal SIGSEGV, Segmentation fault.
0x081107fa in js::gc::CheckMarkedThing<js::Shape> (trc=0x8577ca0, thing=0xf750bd78 "i") at /home/dvander/mozilla/mozilla-inbound/js/src/jsgcmark.cpp:81
81 JS_ASSERT_IF(trc->runtime->gcCurrentCompartment, IS_GC_MARKING_TRACER(trc));
(gdb) bt 10
#0 0x081107fa in js::gc::CheckMarkedThing<js::Shape> (trc=0x8577ca0, thing=0xf750bd78 "i") at /home/dvander/mozilla/mozilla-inbound/js/src/jsgcmark.cpp:81
#1 0x08112fbe in js::gc::MarkInternal<js::Shape> (trc=0x8577ca0, thing=0xf750bd78 "i") at /home/dvander/mozilla/mozilla-inbound/js/src/jsgcmark.cpp:93
#2 0x0810ee00 in js::gc::MarkUnbarriered<js::Shape> (trc=0x8577ca0, thingp=0xffffc5b8, name=0x83c6a56 "write barrier") at /home/dvander/mozilla/mozilla-inbound/js/src/jsgcmark.cpp:132
#3 0x0810b5ee in js::gc::MarkShapeUnbarriered (trc=0x8577ca0, thingp=0xffffc5b8, name=0x83c6a56 "write barrier") at /home/dvander/mozilla/mozilla-inbound/js/src/jsgcmark.cpp:211
#4 0x0808c88b in js::Shape::writeBarrierPre (shape=0xf750bd78 "i") at ../jsscopeinlines.h:399
#5 0x0808fc19 in js::HeapPtr<js::Shape, unsigned int>::pre (this=0xf7506464) at /home/dvander/mozilla/mozilla-inbound/js/src/gc/Barrier.h:243
#6 0x080a83f5 in js::HeapPtr<js::Shape, unsigned int>::operator= (this=0xf7506464, v=0xf750be20 "i") at /home/dvander/mozilla/mozilla-inbound/js/src/gc/Barrier.h:215
#7 0x081ce226 in js::Bindings::setParent (this=0xf7506464, cx=0x859dc98, obj=0xf7503040 [Object global]) at /home/dvander/mozilla/mozilla-inbound/js/src/jsscope.cpp:1397
#8 0x081226fc in js::types::TypeScript::SetScope (cx=0x859dc98, script=0xf7506420, scope=0xf7503040 [Object global]) at /home/dvander/mozilla/mozilla-inbound/js/src/jsinfer.cpp:5197
#9 0x08128ef8 in JSScript::ensureRanAnalysis (this=0xf7506420, cx=0x859dc98, scope=0xf7503040 [Object global]) at ../jsinferinlines.h:1391

(gdb) f 0
#0 0x081107fa in js::gc::CheckMarkedThing<js::Shape> (trc=0x8577ca0, thing=0xf750bd78 "i") at /home/dvander/mozilla/mozilla-inbound/js/src/jsgcmark.cpp:81
81 JS_ASSERT_IF(trc->runtime->gcCurrentCompartment, IS_GC_MARKING_TRACER(trc));
(gdb) p trc.runtime.gcCurrentCompartment
Cannot access memory at address 0x2951
(gdb) p trc.runtime
$1 = (JSRuntime *) 0x1d5