Closed
Bug 390918
Opened 17 years ago
Closed 17 years ago
"Assertion failure: !gen->frame.down" with gc in generator
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: jruderman, Assigned: igor)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(1 file, 2 obsolete files)
1.61 KB,
patch
|
igor
:
review+
igor
:
approval1.9+
|
Details | Diff | Splinter Review |
jsfunfuzz is hitting this every few seconds on trunk: js> for (i in (function(){ gc(); yield null; })()); Assertion failure: !gen->frame.down, at jsiter.c:684
Flags: blocking1.9?
Assignee | ||
Comment 1•17 years ago
|
||
This is caused by my bogus assertion in the patch for bug 390078.
Assignee: general → igor
Blocks: 390078
Assignee | ||
Comment 2•17 years ago
|
||
The reason for the regression is that I forgot that generator's frame became a part of that stack when the generator run. But that also points that the current code does unnecessary marking in that case. When the the frame is active, js_TraceContext traces it as aprt of the JS stack.
Assignee | ||
Comment 3•17 years ago
|
||
I filed bug 390950 about unnecessary tracing.
Assignee | ||
Comment 4•17 years ago
|
||
Here is an alternative test case with better coverage as now it tests for a generator which is being closed. function gen() { gc(); try { yield 1; } finally { gc(); } } var iter = gen(); for (var i in iter) iter.close(); print("OK");
Status: NEW → ASSIGNED
Assignee | ||
Comment 5•17 years ago
|
||
Attachment #275264 -
Flags: review?(brendan)
Attachment #275264 -
Flags: approval1.9?
Assignee | ||
Comment 6•17 years ago
|
||
a new version with better comments
Attachment #275264 -
Attachment is obsolete: true
Attachment #275266 -
Flags: review?(brendan)
Attachment #275266 -
Flags: approval1.9?
Attachment #275264 -
Flags: review?(brendan)
Attachment #275264 -
Flags: approval1.9?
Comment 7•17 years ago
|
||
Comment on attachment 275266 [details] [diff] [review] fix v1b >+ /* >+ * js_TraceStackFrame does not trace recursively the down chain so we Suggest "does not recursively trace the down-linked frame chain, so we ...". >+ * insist that gen->frame has no parent to trace when the generator >+ * is not running. >+ */ >+ JS_ASSERT_IF(gen->state != JSGEN_RUNNING && >+ gen->state != JSGEN_CLOSING, >+ !gen->frame.down); >+ >+ /* >+ * FIXME be 390950. Generator's frame is a part of the JS stack when >+ * the generator is running or closing. Thus tracing the frame in this >+ * case here duplicates the work done in js_TraceContext. >+ */ > js_TraceStackFrame(trc, &gen->frame); > } For future reference, this function should invert the test to return early if (!gen) and avoid over-indenting common code. /be
Attachment #275266 -
Flags: review?(brendan)
Attachment #275266 -
Flags: review+
Attachment #275266 -
Flags: approval1.9?
Attachment #275266 -
Flags: approval1.9+
Assignee | ||
Comment 8•17 years ago
|
||
fix with nits addressed
Attachment #275266 -
Attachment is obsolete: true
Attachment #275298 -
Flags: review+
Attachment #275298 -
Flags: approval1.9+
Assignee | ||
Comment 9•17 years ago
|
||
Here is modified test from comment 4 to test the generator behavior more throughly : function gen() { var c = [1, "x"]; gc(); try { yield c; } finally { gc(); } } var iter = gen(); var i; for (i in iter) { gc(); iter.close(); } if (!(i.length === 2 && i[0] === 1 && i[1] === "x")) throw "Unexpected yield result: "+i;
Assignee | ||
Comment 10•17 years ago
|
||
I checked in the patch from comment 8 to the trunk: Checking in jsiter.c; /cvsroot/mozilla/js/src/jsiter.c,v <-- jsiter.c new revision: 3.70; previous revision: 3.69 done
Assignee | ||
Updated•17 years ago
|
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Reporter | ||
Updated•17 years ago
|
Flags: blocking1.9?
Comment 11•17 years ago
|
||
/cvsroot/mozilla/js/tests/js1_7/geniter/regress-390918.js,v <-- regress-390918.js initial revision: 1.1
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•