TM: Crash using for..in with generator

RESOLVED DUPLICATE of bug 450830

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 450830
9 years ago
9 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
x86
Mac OS X
assertion, crash, regression, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

9 years ago
I pulled from tracemonkey branch (not mozilla-central).


./js -j -v 170
js> a = (function() { for (var t=0;t<4;++t) { let (b) { yield }; } })(); for (var i in a) { }

Assertion failure: !JS_TRACE_MONITOR(cx).recorder ^ (jumpTable == recordingJumpTable), at jsinterp.cpp:3265


./js -j -v 170
js> a = (function() { for (var t=0;t<4;++t) { yield } })(); for (var i in a) { }

Crash [@ nanojit::LIns::isop(nanojit::LOpcode], which makes me think this might be related to bug 451986.

Updated

9 years ago
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 450830
You need to log in before you can comment on or make changes to this bug.