455973 - TM: "Assertion failure: !cx->throwing" with getter that throws

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Jesse Ruderman]

This script triggers an assertion failure when pasted into js> or fed to it on the command line.  -j must be enabled.

for (let i = 0; i < 5; ++i) void (this["y" + i] = "");
this.__defineGetter__("z", function () { throw 2; });
for (let j = 0; j < 2; ++j) { [1 for each (q in this) if ('')]; } 

Assertion failure: !cx->throwing, at jsinterp.cpp:6314

Comment 1

[Jesse Ruderman]

Related to bug 455982?

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix, we need this

Obvious in hindsight -- if we leave trace execution with an exception pending, we had better goto error and try to handle or else propagate it.

/be

Comment 3

[Brendan Eich [:brendan]]

Fixed on tm:

http://hg.mozilla.org/tracemonkey/rev/cf64085bfdfc

/be

Comment 4

[Brendan Eich [:brendan]]

Fixed on m-c:

http://hg.mozilla.org/mozilla-central/rev/cf64085bfdfc

/be

Comment 5

[Bob Clary [:bc] (inactive)]

test landed http://hg.mozilla.org/mozilla-central/rev/620a51565ddb and cvs

Comment 6

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2