在x64下使用SpiderMonkey（libmozjs-45.0.2）创建功能对象分段错误

Question

Hallo我想将C ++函数添加到JSObject并从JavaScript调用该函数。 如果我这样做的话，它会起作用：

     // Create the function Object
    JS::RootedFunction fp (cx, JS_DefineFunction(cx, p_global,"CppVal", JSOperationHandler,  1, 0));

     // Simple JavaScritip with function call
    const char* sinpelTest = "i = 2 + 3;\nz = 5 + i;\nfunction TestAdd(){return CppVal(z+2);}\n TestAdd();";
    test = sinpelTest;

    // Check the Java Script
    if (JS_BufferIsCompilableUnit(
                cx, p_global,
                sinpelTest, strlen(sinpelTest)))
    {

        CompileOptions opts(cx);

        JS::RootedValue rval(cx);
        bool ok;
        ok = false;
        // run the java script and call the cpp function
        ok = Evaluate(cx, opts, sinpelTest, strlen(sinpelTest), &rval);
    }

通过函数调用创建JSFunction *我遇到了SEG-故障。

// Create the Function Pointer
bool CreateOperation(JS::MutableHandleFunction fp, JSContext* context,JS::RootedObject& hObj,std::string name, uint32_t parmCount, uint32_t parmAttribute)
{
    // JS::MutableHandleFunction should handle the GC issues
    JSFunction* ret = JS_DefineFunction(context, hObj,
                                  name.c_str(), JSTriesOperationHandler,  
                                  parmCount, parmAttribute);
    if (ret != nullptr )
    {
        fp.set(ret);
        // for acces to JSObject in the call back JSTriesOperationHandler
        JS_SetPrivate(ret, hObj.get());
    }

    return ret != NULL;
}

   // calling CreateOperation
    JS::RootedFunction fp (cx);
    CreateOperation(&fp,cx,p_global,std::string("CppVal"), 1);

     // Simple JavaScritip with function call
    const char* sinpelTest = "i = 2 + 3;\nz = 5 + i;\nfunction TestAdd(){return CppVal(z+2);}\n TestAdd();";
    test = sinpelTest;
    if (JS_BufferIsCompilableUnit(
                cx, p_global,
                sinpelTest, strlen(sinpelTest)))
    {

        CompileOptions opts(cx);

        JS::RootedValue rval(cx);

        bool ok;
        ok = false;
        // SEG Fault Why this happend?
        ok = Evaluate(cx, opts, sinpelTest, strlen(sinpelTest), &rval);

    }

调试器在以下行中停止： TenuredCell :: readBarrier（TenuredCell *事物） {     ...     MOZ_ASSERT（！isNullLike（thing））;