524264 - "Assertion failure: 0, at ../jsopcode.cpp" with uneval, yield, Function, do...while

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

uneval(Function("\
  do {\
  for each(y in []) {\
    yield\
    }\
  }\
  while(x)\
"))

asserts js debug shell without -j on TM tip at Assertion failure: 0, at ../jsopcode.cpp:3312. This seems to occur frequently.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 522624:

The first bad revision is:
changeset:   34070:5ab2276549b1
user:        David Anderson
date:        Fri Oct 23 14:28:35 2009 -0700
summary:     Fixed decompiler assertion related to JSOP_TRACE (bug 522624, r=brendan).

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

I can't win against this thing.

Comment 3

[Jason Orendorff [:jorendorff]]

Smaller test case:

uneval(function () { do yield; while (0); });

dvander and I figured this out on IRC. js_DecompileFunction is fixing up pc to skip a JSOP_TRACE opcode that isn't there for generators.

Comment 4

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 5

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/bd1b0c451b85

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/bd1b0c451b85

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/tests/js1_8_1/regress/regress-524264.js.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.