463783 - Assertion failed: "need a way to EOT now, since this is trace end" with array comprehension

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

./js -j a.js
Assertion failed: "need a way to EOT now, since this is trace end": 0 (../nanojit/LIR.cpp:944)

a.js:
  var a = [0,1,2,3,4,5];
  for (let f in a);
  [(function(){})() for each (x in a) if (x)];

Gary found this with jsfunfuzz, and I helped reduce it.  Only crashes when the file is given on the command line, not when its contents are pasted into the interactive shell.

The same assertion happens in bug 463782, but I doubt that site uses array comprehensions, so I'm filing this separately.

It's important that the first item in the array is zero.  I'm guessing that's because it affects the "if (x)" thing.

Comment 1

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

WFM on tracemonkey 62c408f40d3c, waiting on my m-c pull to finish so I can test there.

Comment 2

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Still fails on m-c, so it needs the merge.

Comment 3

[Jesse Ruderman]

No longer asserts on mozilla-central, thanks to today's merge from tracemonkey.

Comment 4

[:Gavin Sharp [email: [e-mail]]]

WFM on 1.9.1 as well (even though tracemonkey-62c408f40d3c didn't make it there, must have been a different fix).

Comment 5

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/35ae056cf2f1
/cvsroot/mozilla/js/tests/js1_8/regress/regress-463783.js,v  <--  regress-463783.js
initial revision: 1.1

Comment 6

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2