Crashes on simulator, works on iPad

[mschulkind]

I've got some pretty simple JS snippets (at the end of this issue), one snippet runs on both environments, one crashes on the simulator as the title would indicate.

Here's the setup code I use:

static JSClass jsGlobalClass = {
    "global", JSCLASS_GLOBAL_FLAGS,
    JS_PropertyStub, JS_PropertyStub, JS_PropertyStub, JS_PropertyStub,
    JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub, JS_FinalizeStub,
    JSCLASS_NO_OPTIONAL_MEMBERS
};

void reportError(JSContext* cx, const char* message, JSErrorReport* report)
{
  NSLog(
      @"%s:%u:%s\n",
      report->filename ? report->filename : "<no filename>",
      (unsigned int) report->lineno, message);
}

- (void)loadJavascriptFile:(NSString*)filename
{
  NSString* filePath =
      [[NSBundle mainBundle] pathForResource:
          [NSString stringWithFormat:@"www/%@", filename] ofType:nil];  
  NSData *jsData = [NSData dataWithContentsOfFile:filePath];  
  assert(jsData);

  assert(
      JS_EvaluateScript(
        jsContext_, jsGlobalObject_, (const char*)[jsData bytes],
        [jsData length], 
        [filename cStringUsingEncoding:NSASCIIStringEncoding], 1, NULL)
      == JS_TRUE);
}

// See here for more info:
// https://developer.mozilla.org/En/SpiderMonkey/JSAPI_User_Guide
- (void)setupSpiderMonkey
{
  jsRuntime_ = JS_NewRuntime(8L * 1024L * 1024L);
  assert(jsRuntime_);

  // Create a context. 
  jsContext_ = JS_NewContext(jsRuntime_, 8192);
  assert(jsContext_);

  JS_SetOptions(
      jsContext_, 
      JS_GetOptions(jsContext_)
      | JSOPTION_VAROBJFIX | JSOPTION_COMPILE_N_GO | JSOPTION_STRICT
      | JSVERSION_LATEST);
  JS_SetVersion(jsContext_, JSVERSION_LATEST);
  JS_SetErrorReporter(jsContext_, reportError);

  JS_BeginRequest(jsContext_);

  // Create the global object.
  jsGlobalObject_ = JS_NewObject(jsContext_, &jsGlobalClass, NULL, NULL);
  assert(jsGlobalObject_);

  JS_SetGlobalObject(jsContext_, jsGlobalObject_);

  // Populate the global object with the standard globals, like object and
  // array. 
  assert(JS_InitStandardClasses(jsContext_, jsGlobalObject_));

  [self loadJavascriptFile:@"foo.js"];

  JS_EndRequest(jsContext_);

  NSLog(@"Done setting up SpiderMonkey");
}

Here's the snippet that works just fine on both:

(function() {
  var foo = 3;

  var bar = function () {
    return 3;
  }
})();

Now, with one minor change, it just simply crashes before getting ot the "Done" log line:

(function() {
  var foo = 3;

  var bar = function () {
    return foo;
  }
})();

Note the "return foo" instead of "return 3".

I have not been able to get any useful information from debugging, since the stack is trashed it seems. Here's a backtrace from a crash (they're all very similar to this):

(gdb) bt
#0  0x06821c12 in ?? ()
#1  0x00ebffff in sRGBColorSpace.41093 ()

If I remove the wrapper function, both snippets work fine. I've tried things like disabling some of the inline assembly targetted at i386, as well as rolling back to before the simulator and device targets were unified, disabling the fat library build script, etc. but nothing has helped. I get the exact same crash every time.