Assertion failed: "need a way to EOT now, since this is trace end" with array comprehension

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
9 years ago
9 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase, verified1.9.1})

Trunk
x86
Mac OS X
assertion, testcase, verified1.9.1
Points:
---
Bug Flags:
blocking1.9.1 +
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

9 years ago
./js -j a.js
Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:944)

a.js:
  var a = [0,1,2,3,4,5];
  for (let f in a);
  [(function(){})() for each (x in a) if (x)];

Gary found this with jsfunfuzz, and I helped reduce it.  Only crashes when the file is given on the command line, not when its contents are pasted into the interactive shell.

The same assertion happens in bug 463782, but I doubt that site uses array comprehensions, so I'm filing this separately.

It's important that the first item in the array is zero.  I'm guessing that's because it affects the "if (x)" thing.

Updated

9 years ago
Flags: blocking1.9.1+
WFM on tracemonkey 62c408f40d3c, waiting on my m-c pull to finish so I can test there.
Whiteboard: fixed-in-tracemonkey
Still fails on m-c, so it needs the merge.
(Reporter)

Comment 3

9 years ago
No longer asserts on mozilla-central, thanks to today's merge from tracemonkey.
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
WFM on 1.9.1 as well (even though tracemonkey-62c408f40d3c didn't make it there, must have been a different fix).
Keywords: fixed1.9.1
Whiteboard: fixed-in-tracemonkey

Comment 5

9 years ago
http://hg.mozilla.org/mozilla-central/rev/35ae056cf2f1
/cvsroot/mozilla/js/tests/js1_8/regress/regress-463783.js,v  <--  regress-463783.js
initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-

Comment 6

9 years ago
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.