484628 - TM: "Assertion failure: *regs.pc == JSOP_CALL || *regs.pc == JSOP_DUP, at ../jsinterp.cpp"

Status: RESOLVED DUPLICATE of bug 485022

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

__defineGetter__("x", function(y) { yield y; });
z = x;
[0 for each (a in [-1e81, 0, 0]) for each (w in z)]

Assertion failure: *regs.pc == JSOP_CALL || *regs.pc == JSOP_DUP, at ../jsinterp.cpp:6954 with debug js shell and -j on.

autoBisect shows bug 463238 or http://hg.mozilla.org/tracemonkey/rev/1c6be1c210b9 may be related:

The first bad revision is:
changeset:   26344:1c6be1c210b9
user:        Andreas Gal
date:        Fri Mar 20 18:52:11 2009 -0700
summary:     Support calling arbitrary JSFastNatives from trace (463238, r=brendan).

Comment 1

[Bob Clary [:bc] (inactive)]

covered by browser tests for 

js1_6/Regress/regress-476655.js
js1_6/extensions/regress-455464-03.js
js1_6/extensions/regress-472508.js
js1_7/regress/regress-453051.js
js1_8/extensions/regress-452476.js
js1_8/regress/regress-457065-01.js

Comment 2

[Bob Clary [:bc] (inactive)]

ditto (w/-j on both sets)

ecma/ExecutionContexts/10.2.1.js
ecma/ExecutionContexts/10.2.2-1.js
ecma/ExecutionContexts/10.2.2-2.js
ecma/Statements/12.6.3-12.js
js1_5/extensions/regress-436741.js
js1_8/extensions/regress-476427.js
js1_8_1/JSON/regress-458959.js
js1_8_1/decompilation/regress-353249.js

Comment 3

[Andreas Gal :gal]

debug only. fix in a sec.

Comment 4

[Andreas Gal :gal]

Attachment: patch

Due to bug 474854 pc is advanced when we see an exception, and a new imacro was added for NEXTITER that could stop on TRUE in this case (in addition to DUP).

Comment 6

[Andreas Gal :gal]

Comment on attachment 369103 [details] [diff] [review]
patch

Patch no longer needed. Fixed by 485022.

Comment 7

[Christian Holler (:decoder)]

Bug in removed tracer code, setting in-testsuite- flag.