Crash [@ nanojit::LIns::isop] with generator, NaN

RESOLVED FIXED in mozilla1.9.1b2

Status

()

Core
JavaScript Engine
P1
critical
RESOLVED FIXED
9 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Assigned: brendan)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
mozilla1.9.1b2
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
function gen() { for (var j = 0; j < 4; ++j) { NaN; yield 3; } }
for (let i in gen()) { }

Crash [@ nanojit::LIns::isop]
(Reporter)

Comment 1

9 years ago
Regression from bug 458851.
Blocks: 458851
Keywords: regression
(Assignee)

Updated

9 years ago
No longer blocks: 458851
(Assignee)

Updated

9 years ago
Blocks: 458851
(Assignee)

Updated

9 years ago
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b2
(Assignee)

Comment 2

9 years ago
Created attachment 345175 [details] [diff] [review]
spot fix

I will investigate fixing generators for good before going with this.

/be
Attachment #345175 - Flags: review?(danderson)
Attachment #345175 - Flags: review?(danderson) → review+
(Assignee)

Comment 3

9 years ago
Fixed by the patch for bug 456511 (imacros FTW!).

/be
Depends on: 456511
(Assignee)

Comment 4

9 years ago
Bug 456511 has the fix.

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Comment 5

9 years ago
test landed http://hg.mozilla.org/mozilla-central/rev/c7d686d5ec4c and cvs
Flags: in-testsuite+
Flags: in-litmus-
Crash Signature: [@ nanojit::LIns::isop]
You need to log in before you can comment on or make changes to this bug.