455982 - TM: "Assertion failure: JS_ON_TRACE(cx)" with generator as getter

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

./js -j

for (let i=0;i<5;++i) this["y" + i] = function(){};
this.__defineGetter__('e', function (x2) { yield; });
[1 for each (a in this) for (b in {})];

Assertion failure: JS_ON_TRACE(cx), at jsbuiltins.cpp:647

I wonder why the second line doesn't throw "invalid getter usage".

Related to bug 455973?

Comment 1

[Jason Orendorff [:jorendorff]]

(In reply to comment #0)
> for (let i=0;i<5;++i) this["y" + i] = function(){};
> this.__defineGetter__('e', function (x2) { yield; });
>
> I wonder why the second line doesn't throw "invalid getter usage".

A generator-function is in fact a function.  It's just a function that returns a new iterator each time you call it.

js> this.__defineGetter__('e', function (x2) { yield; });
js> e
[object Generator]

Comment 2

[Brendan Eich [:brendan]]

The testcase WFM now due to the patch for bug 457335. I tried this to re-trigger the assertbotch:

for (let i=0;i<5;++i) this["y" + i] = function(){};
this.__defineGetter__('e', function (x2) { yield; });
[1 for each (a in this) for (b in {p:1,q:2,r:3})];

but got only expected output:

1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1

Jesse, can you find a new testcase that produces the same symptom, or else mark FIXED if you agree the patch for bug 457335 fixed this bug? Thanks,

/be

Comment 3

[Jesse Ruderman]

I'll file a new bug if jsfunfuzz hits this assertion again.

Comment 4

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_7/extensions/regress-455982-01.js,v  <--  regress-455982-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_7/extensions/regress-455982-02.js,v  <--  regress-455982-02.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/b04c04268a94

Comment 5

[Jason Orendorff [:jorendorff]]

This is happening to me on tip. Taking.

Comment 6

[Jason Orendorff [:jorendorff]]

Reentering through js_FastCallIteratorNext.

So bug 462027 will fix this.

#0  js_Interpret (cx=0x3010f0) at jsinterp.cpp:2576
#1  0x0009c584 in js_Invoke (cx=0x3010f0, argc=0, vp=0x808440, flags=0) at jsinterp.cpp:1324
#2  0x0009c83a in js_InternalInvoke (cx=0x3010f0, obj=0x261000, fval=2495008, flags=0, argc=0, argv=0x0, rval=0xbfffa46c) at jsinterp.cpp:1381
#3  0x0009ca9b in js_InternalGetOrSet (cx=0x3010f0, obj=0x261000, id=2504348, fval=2495008, mode=JSACC_READ, argc=0, argv=0x0, rval=0xbfffa46c) at jsinterp.cpp:1442
#4  0x000aeaa1 in js_NativeGet (cx=0x3010f0, obj=0x261000, pobj=0x261000, sprop=0x805990, vp=0xbfffa46c) at jsobj.cpp:3664
#5  0x000af863 in js_GetPropertyHelper (cx=0x3010f0, obj=0x261000, id=2504348, vp=0xbfffa46c, entryp=0x0) at jsobj.cpp:3813
#6  0x000af8f6 in js_GetProperty (cx=0x3010f0, obj=0x261000, id=2504348, vp=0xbfffa46c) at jsobj.cpp:3825
#7  0x0009e865 in CallEnumeratorNext (cx=0x3010f0, iterobj=0x261300, flags=3, rval=0xbfffa46c) at jsiter.cpp:566
#8  0x0009e975 in js_CallIteratorNext (cx=0x3010f0, iterobj=0x261300, rval=0xbfffa46c) at jsiter.cpp:600
#9  0x0011d9dd in js_FastCallIteratorNext (cx=0x3010f0, iterobj=0x261300) at jsbuiltins.cpp:249
#10 0x0026efb4 in ?? ()
#11 0x00128067 in js_ExecuteTree (cx=0x3010f0, f=0x3031c0, inlineCallCount=@0xbfffda88, innermostNestedGuardp=0xbfffce54) at jstracer.cpp:3210
#12 0x0013dada in js_MonitorLoopEdge (cx=0x3010f0, inlineCallCount=@0xbfffda88) at jstracer.cpp:3488
#13 0x00062c35 in js_Interpret (cx=0x3010f0) at jsinterp.cpp:3074
#14 0x0009b08c in js_Execute (cx=0x3010f0, chain=0x261000, script=0x303540, down=0x0, flags=0, result=0xbffff724) at jsinterp.cpp:1550
#15 0x00018d6e in JS_ExecuteScript (cx=0x3010f0, obj=0x261000, script=0x303540, rval=0xbffff724) at jsapi.cpp:5071
#16 0x00002674 in Process (cx=0x3010f0, obj=0x261000, filename=0x0, forceTTY=0) at js.cpp:316
#17 0x00007e8e in ProcessArgs (cx=0x3010f0, obj=0x261000, argv=0xbffff888, argc=1) at js.cpp:576
#18 0x00009004 in main (argc=1, argv=0xbffff888, envp=0xbffff890) at js.cpp:4030

Comment 8

[Bob Clary [:bc] (inactive)]

js1_7/extensions/regress-455982-01.js asserts:

1.9.1: 
Assertion failure: !(fp->flags & JSFRAME_POP_BLOCKS), at ../jstracer.cpp:3688

1.9.1-tracemonkey and 1.9.2:
Assertion failure: JS_ON_TRACE(cx), at ../jsbuiltins.cpp:328

Comment 9

[Andreas Gal :gal]

The assert in #8 is fixed by 474771, which has not landed yet.

Comment 10

[Robert Sayre]

474771 is fixed

Comment 11

[Robert Sayre]

474771 is fixed1.9.1, so this should be too.

Comment 12

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2