352605 - yield with nested xml-filtering-predicates can still cause assertion failure

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Jesse Ruderman]

Even though bug 350809 is fixed, it is still possible to trigger assertions with *nested* xml filtering predicate operators:

js> (function() { <y/>.(<x/>.(false), (yield 3)) })().next()
Assertion failure: fp->sp == sp, at jsinterp.c:5765

Perhaps exiting from the inner filtering expression screws with the JSFRAME_FILTERING flag that the patch in bug 350809 relies on?

Comment 1

[Jesse Ruderman]

In today's Firefox nightly, this testcase doesn't crash.  It does fail to throw "yield not yet supported from filtering predicate", of course.

Comment 2

[Brendan Eich [:brendan]]

This is critical only because JS_ASSERT is fatal in debug builds.  In release builds it's not so bad, but since the inner filter clears the flag, the outer one may find its rethrown exceptions caught twice by the same catch.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix

Easy fix.

/be

Comment 4

[Jeff Walden (gone starting June 8)]

Comment on attachment 238360 [details] [diff] [review]
fix

(In reply to comment #3)
> Easy fix.

Indeed.  :-)

Comment 5

[Brendan Eich [:brendan]]

Fixed on trunk.  I'm not going to bother the 1.8.1 drivers with this, even though it is zero-risk.  Anyone who feels differently may nominate the patch.

/be

Comment 6

[Bob Clary [:bc] (inactive)]

Checking in regress-352605.js;
/cvsroot/mozilla/js/tests/js1_7/geniter/regress-352605.js,v  <--  regress-352605.js
initial revision: 1.1
done

Comment 7

[Bob Clary [:bc] (inactive)]

"yield not yet supported from filtering predicate"

Checking in regress-352605.js;
/cvsroot/mozilla/js/tests/js1_7/geniter/regress-352605.js,v  <--  regress-352605.js
new revision: 1.2; previous revision: 1.1
done

verified fixed no assert 1.9 20060914 windows/mac*/linux

Comment 8

[Brendan Eich [:brendan]]

Fix was needed to merge fix for approved bug 353249.

/be

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 1.8, 1.9 20061002 windows/linux and 1.8 macppc.