463334 - TM: Crash [@ isPromoteInt] with generator

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

u = 3;
for (let i in (function() { for (var j=0;j<4;++j) { void u; yield; } })());

Crash [@ isPromoteInt] called by TraceRecorder::determineSlotType.

jsfunfuzz is hitting this a lot, so I'm guessing this is a regression from earlier today.

Comment 1

[Brendan Eich [:brendan]]

The imacros patch in bug 456511 fixes this.

/be

Comment 2

[Jesse Ruderman]

The testcase in comment 0 WFM, but here's another testcase that triggers the crash:

for (let i in (function() { for (let j = 0; j < 4; ++j) with({t: NaN}) yield; })()) { }

Comment 3

[Jesse Ruderman]

This bug keeps showing up with different assertion failures and crash signatures :(

Comment 4

[Andreas Gal :gal]

Brendan is about to fix this, hang in there. I already reviewed his patch. We are just waiting for the tree to go green.

Comment 5

[Andreas Gal :gal]

This still asserts.

Comment 6

[Brendan Eich [:brendan]]

Fixed bogus assertion:

http://hg.mozilla.org/tracemonkey/rev/b6bc52a55c89
http://hg.mozilla.org/mozilla-central/rev/4bfb610c88f6

Fixed by patch for bug 456511 plus this assertion fix.

/be

Comment 7

[Bob Clary [:bc] (inactive)]

test landed http://hg.mozilla.org/mozilla-central/rev/ccb860b3b4a5 and cvs

Comment 8

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2