765907 - eif-generator.js assertion error with gc zeal at 4

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[:Benjamin Peterson]

$ JS_GC_ZEAL=4 jit-test/jit_test.py _DBJ.OBJ/js eif-generator -o
Assertion failure: addr % Cell::CellSize == 0, at ../gc/Heap.h:825

Comment 1

[Luke Wagner [:luke]]

Attachment: fix

Ah, so the problem is that it is totally bogus to copy a generator frame's slot values into the call object when the generator is about to finalized (duh).  Rather than trying to dance around to make this work, I'd rather just remove the copy since it only helps preserve debugger values in a presumably rare corner case.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 634271 [details] [diff] [review]
fix

This looks fine to me. Jim, I just want to make sure you're okay losing this debugger feature.

Comment 3

[Luke Wagner [:luke]]

The code removal here is definitely a necessary fix, since the values are potentially garbage, so "not losing the debugger feature" is really "adding a debugger feature" which would imply a new bug.

Comment 4

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0d94dbf7ae1e
and filed bug 768220 as followup.

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/0d94dbf7ae1e