477581 - "Assertion failure: !JSVAL_IS_PRIMITIVE(regs.sp[-2]), at ../jsinterp.cpp:3237" with generator on trace

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jason Orendorff [:jorendorff]]

Probably a regression from bug 462027.

function g() { yield 2; }
var iterables = [[1], [], [], [], g()];
for (let i = 0; i < iterables.length; i++)
    for each (let j in iterables[i])
        ;

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: v1

I don't know what I was thinking adding the check for GeneratorClass there.

There are two calls to js_LeaveTrace in generator_op, both with blame=me no doubt; the second is of course redundant.

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 361249 [details] [diff] [review]
v1

Who reviewed that patch? :-P

Thanks for cleaning this up.

/be

Comment 3

[Brendan Eich [:brendan]]

Want this in 1.9.1 ASAP.

/be

Comment 4

[Jason Orendorff [:jorendorff]]

Pushed earlier today.

http://hg.mozilla.org/tracemonkey/rev/87734acac558

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/87734acac558

Comment 6

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/e9b89d4d2779

Comment 7

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/08ba579aeec1

Comment 8

[Bob Clary [:bc] (inactive)]

js1_8/regress/regress-477581.js
v 1.9.1, 1.9.2