Bug 457065. TM: Assertion failure: !fp->callee || fp->thisp == JSVAL_TO_OBJECT(fp->argv[-1]). r=mrbkap

js/src/jstracer.cpp

@@ -4207,7 +4207,9 @@ LeaveTree(InterpState& state, VMSideExit* lr)
     // Verify that our state restoration worked
     for (JSStackFrame* fp = cx->fp; fp; fp = fp->down) {
         JS_ASSERT(!fp->callee || JSVAL_IS_OBJECT(fp->argv[-1]));
-        JS_ASSERT(!fp->callee || fp->thisp == JSVAL_TO_OBJECT(fp->argv[-1]));
+        JS_ASSERT_IF(fp->callee && fp->thisp != JSVAL_TO_OBJECT(fp->argv[-1]),
+                     !(fp->flags & JSFRAME_COMPUTED_THIS) && !fp->thisp);
+        
     }
 #endif
 #ifdef JS_JIT_SPEW