From 4c588f141c9adc552d59dfbc0222b4a3487a3b2d Mon Sep 17 00:00:00 2001
From: Jason Orendorff <jorendorff@mozilla.com>
Date: Fri, 12 Aug 2011 06:35:37 -0500
Subject: [PATCH] Bug 678211 - Assertion failure: isScriptFrame(), at
 ../vm/Stack.h:538 with dummy frame. r=dvander.

---
 js/src/jit-test/tests/basic/bug678211.js | 3 +++
 js/src/jstracer.cpp                      | 5 ++++-
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/basic/bug678211.js

diff --git a/js/src/jit-test/tests/basic/bug678211.js b/js/src/jit-test/tests/basic/bug678211.js
new file mode 100644
index 00000000000..61b5f5d197c
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug678211.js
@@ -0,0 +1,3 @@
+var g = newGlobal('new-compartment');
+g.eval("function f(n) { for (var i = 0; i < n; i++) f(0); }");
+g.f(RUNLOOP + 1);
diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 071baa17ca8..49d3a2e6973 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -10467,7 +10467,10 @@ TraceRecorder::record_EnterFrame()
 
     /* Try inlining one level in case this recursion doesn't go too deep. */
     if (fp->script() == fp->prev()->script() &&
-        fp->prev()->prev() && fp->prev()->prev()->script() == fp->script()) {
+        fp->prev()->prev() &&
+        fp->prev()->prev()->isScriptFrame() &&
+        fp->prev()->prev()->script() == fp->script())
+    {
         RETURN_STOP_A("recursion started inlining");
     }