341499 - Iterators: allocation of GC things from a close handler asserts

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Igor Bukanov]

Consider the following test case for the shell:

ar iter = (function() { yield 0; })();
iter.close = function() { return []; }
gc();

Currently it asserts:

before 9232, after 9232, break 0910a000
Assertion failure: !rt->gcRunning, at jsgc.c:823
Trace/breakpoint trap

Comment 1

[Igor Bukanov]

Attachment: Fix

As I remember this change was in one of the initial Brandan's patches but then it got lost somehow.

Comment 2

[Brendan Eich [:brendan]]

(In reply to comment #1)
> Created an attachment (id=225563) [edit]
> Fix
> 
> As I remember this change was in one of the initial Brandan's patches but then
> it got lost somehow.

I had cvs conflicts updating with the big generators patch for bug 326466, after your checkin for bug 338653.  It was easier to redo my changes in the context of your revised js_NewGCThing, but I missed this hunk.  D'oh!

/be

Comment 3

[Igor Bukanov]

I committed the patch from comment 1 to the trunk.

Comment 4

[Bob Clary [:bc] (inactive)]

RCS file: /cvsroot/mozilla/js/tests/js1_7/iterable/regress-341499.js,v
done
Checking in regress-341499.js;
/cvsroot/mozilla/js/tests/js1_7/iterable/regress-341499.js,v  <--  regress-341499.js
initial revision: 1.1
done

Comment 5

[Bob Clary [:bc] (inactive)]

trunk 1.9 debug browser windows js1_7/iterable/regress-341499.js

>	js3250.dll!QuoteString(Sprinter * sp=0x0012dd60, JSString * str=0x03aa3bf0, unsigned short quote=34)  Line 466 + 0x3 bytes	C
 	js3250.dll!js_QuoteString(JSContext * cx=0x039eb880, JSString * str=0x03aa3bf0, unsigned short quote=34)  Line 541 + 0x12 bytes	C
 	js3250.dll!js_ValueToSource(JSContext * cx=0x039eb880, long v=61488116)  Line 2702 + 0x12 bytes	C
 	js3250.dll!js_DecompileValueGenerator(JSContext * cx=0x039eb880, int spindex=-74, long v=61488116, JSString * fallback=0x00000000)  Line 3433 + 0x1b bytes	C
 	js3250.dll!js_Interpret(JSContext * cx=0x039eb880, unsigned char * pc=0x03d4081b, long * result=0x0012e80c)  Line 6164 + 0x1f bytes	C
 	js3250.dll!generator_send(JSContext * cx=0x039eb880, JSObject * obj=0x03d2cc70, unsigned int argc=0, long * argv=0x03e69708, long * rval=0x0012e8f8)  Line 795 + 0x14 bytes	C
 	js3250.dll!generator_close(JSContext * cx=0x039eb880, JSObject * obj=0x03d2cc70, unsigned int argc=0, long * argv=0x03e69708, long * rval=0x0012e8f8)  Line 846 + 0x17 bytes	C
 	js3250.dll!js_Invoke(JSContext * cx=0x039eb880, unsigned int argc=0, unsigned int flags=2)  Line 1350 + 0x20 bytes	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x039eb880, JSObject * obj=0x03d2cc70, long fval=64146600, unsigned int flags=0, unsigned int argc=0, long * argv=0x00000000, long * rval=0x0012ea4c)  Line 1448 + 0x14 bytes	C
 	js3250.dll!js_CloseGeneratorObject(JSContext * cx=0x039eb880, JSGenerator * gen=0x03df6b60)  Line 623 + 0x1b bytes	C
 	js3250.dll!js_RunCloseHooks(JSContext * cx=0x039eb880)  Line 1057 + 0xd bytes	C
 	js3250.dll!JS_GC(JSContext * cx=0x039eb880)  Line 1943 + 0x9 bytes	C
 	js3250.dll!JS_MaybeGC(JSContext * cx=0x039eb880)  Line 2009 + 0x9 bytes	C
 	gklayout.dll!nsJSContext::DOMBranchCallback(JSContext * cx=0x039eb880, JSScript * script=0x03c29570)  Line 688 + 0xa bytes	C++

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060818 windows/mac(ppc|tel)/linux