461915 - Crash [@ NativeToValue] with gc and generator as getters

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Testcase from Gary:

var o = {a:1,b:1,c:1,d:function(){},e:function(){}};
o.__defineGetter__('x', function(y) { yield; });
o.__defineGetter__('y', gc);
[1 for each (z in o) if (NaN)]

Opt: crash [@ NativeToValue] dereferencing 0x007ffffc

Debug: Assertion failure: ngslots == tm->globalTypeMap->length(), at jstracer.cpp:3407

The assertion is the same as in bug 458857, but the opt behavior is different and scarier.  Is this the same bug?

Comment 1

[Brendan Eich [:brendan]]

This should be tested now that bug 458851 has been fixed in tracemonkey. It looks like a dup of that bug. It WFM now.

This probably means bug 458857 is a dup of bug 458851 too. Please help test and mark accordingly. Thanks,

/be

Comment 2

[Jesse Ruderman]

This testcase WFM, but I still see bug 458857.

Comment 3

[Bob Clary [:bc] (inactive)]

Attachment: js1_7/extensions/regress-461915.js

I couldn't reproduce the issues with this test case.

Comment 4

[Bob Clary [:bc] (inactive)]

verified no failures mozilla-central, tracemonkey modulo comment 3

Comment 5

[:Gavin Sharp [email: [e-mail]]]

Marking verified1.9.1 per http://hg.mozilla.org/releases/mozilla-1.9.1/rev/08b215e43638 and bug 458851 comment 17.

Comment 6

[Bob Clary [:bc] (inactive)]

when this bug is opened, the test should be checked in.