stopping generators cause Firefox to freeze (unresponsive script dialog)

RESOLVED DUPLICATE of bug 1012480

Status

()

RESOLVED DUPLICATE of bug 1012480
4 years ago
4 years ago

People

(Reporter: freddyb, Unassigned)

Tracking

({regression, reproducible})

unspecified
x86_64
All
regression, reproducible
Points:
---

Firefox Tracking Flags

(firefox31 affected, firefox32 affected, firefox33 affected, firefox34 fixed, firefox-esr24 unaffected, firefox-esr31 affected)

Details

Attachments

(1 attachment)

Code snippet:
> g= function* () { var x = 5; while (x < 3) { yield x--; } }; l=g(); for (element in l) { console.log(element) }


Tim Taubert (CCd) says this is relevant:
> Assertion failure: cx->iterValue.isMagic(JS_NO_ITER_VALUE), at 
 /Users/tim/workspace/mozilla-central/js/src/vm/Interpreter.cpp:434

I get this on release & nightly, Mac and Linux.
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3e40f7389d1b&tochange=44ba69cacd7e

Should have been regressed by bug 958951.
Blocks: 958951
status-firefox31: --- → affected
status-firefox32: --- → affected
status-firefox33: --- → affected
status-firefox34: --- → affected
status-firefox-esr24: --- → unaffected
status-firefox-esr31: --- → affected
Keywords: regression
Keywords: reproducible
Seems to be dupe of bug 1012480.
  [x for (x in function*(){}())]

Need to backport to esr31?
Created attachment 8549476 [details] [diff] [review]
Do not treat star generator's iterator as legacy generator's iterator in for..in loop. r=jorendorff

Confirmed the patch for bug 1012480 fixes this, it's landed to mozilla34.
Exactly same patch is applicable to esr31,

Updated

4 years ago
status-firefox34: affected → fixed

Updated

4 years ago
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1012480
You need to log in before you can comment on or make changes to this bug.