Closed
Bug 452167
Opened 16 years ago
Closed 16 years ago
TM: Crash using for..in with generator
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 450830
People
(Reporter: jruderman, Unassigned)
Details
(4 keywords)
I pulled from tracemonkey branch (not mozilla-central).
./js -j -v 170
js> a = (function() { for (var t=0;t<4;++t) { let (b) { yield }; } })(); for (var i in a) { }
Assertion failure: !JS_TRACE_MONITOR(cx).recorder ^ (jumpTable == recordingJumpTable), at jsinterp.cpp:3265
./js -j -v 170
js> a = (function() { for (var t=0;t<4;++t) { yield } })(); for (var i in a) { }
Crash [@ nanojit::LIns::isop(nanojit::LOpcode], which makes me think this might be related to bug 451986.
|
||
Updated•16 years ago
|
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•