345558 - abort() in js_CallIteratorNext

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

When doing some manual iteration partially using the default iterator Object.prototype.__iterator__. The code dies when asserting 
JS_ASSERT(flags & JSITER_HIDDEN) in js_CallIteratorNext

The top of the callstack is

 	js3250.dll!JS_Assert(const char * s=0x0053cb74, const char * file=0x0053cb4c, int ln=0x000001e1)  Line 62	C
>	js3250.dll!js_CallIteratorNext(JSContext * cx=0x04392608, JSObject * iterobj=0x052770d0, unsigned int flags=0x0012b708, long * idp=0x00000000, long * rval=0x0012b6e0)  Line 481 + 0x1e	C
 	js3250.dll!js_Interpret(JSContext * cx=0x04392608, unsigned char * pc=0x051c5ef6, long * result=0x0012b740)  Line 2732 + 0x31	C
 	js3250.dll!generator_send(JSContext * cx=0x04392608, JSObject * obj=0x05276d78, unsigned int argc=0x00000000, long * argv=0x0524f97c, long * rval=0x0012b810)  Line 788 + 0x14	C
 	js3250.dll!generator_next(JSContext * cx=0x04392608, JSObject * obj=0x05276d78, unsigned int argc=0x00000000, long * argv=0x0524f97c, long * rval=0x0012b810)  Line 813 + 0x17	C
 	js3250.dll!js_Invoke(JSContext * cx=0x04392608, unsigned int argc=0x00000000, unsigned int flags=0x00000002)  Line 1349 + 0x20	C

Comment 1

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Attachment: Patch to expose assertion

The change to extensions/inspector/install.rdf is just to get the DOM inspector working on firefox trunk, but may not be needed any more.

To get the abort open the DOM Inspector (ctrl+shift+i) and choose the "Javascript Object" view in the right pane.

Comment 2

[Brendan Eich [:brendan]]

I hope to fix this with the patch for bug 346021.

/be

Comment 3

[Brendan Eich [:brendan]]

Now that bug 346021 is fixed, is this still biting?  Jonas, if you update and still see trouble, ping me on IRC and I'll help debug any remaining problem.

/be

Comment 4

[Brendan Eich [:brendan]]

Jonas said this went away, presumably with the fix for bug 346021.

/be