521694 - "Assertion failure: traceOp == JSOP_TRACE || traceOp == JSOP_NOP, at ../jsops.cpp" with yield

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for(e in((function x(){yield(p=x())})())){}

asserts js debug shell without -j on TM tip at Assertion failure: traceOp == JSOP_TRACE || traceOp == JSOP_NOP, at ../jsops.cpp:2234

I'm guessing from the regression window found by autoBisect that the tracerecursion bug is related...

http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=0c933cb67ef7&tochange=5247cfd604db

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

This should be the fix -- David, let me know if there's more than meets the eye here (e.g., a generator that recursively activates itself via iteration/.next()).

/be

Comment 2

[Robert Sayre]

paperwork question: does this need to target 1.9.2? Don't think recursion will make it there.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 405819 [details] [diff] [review]
fix

Indeed, recursion shouldn't land on 1.9.2 so this shouldn't block.

Comment 4

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/8c7a6ec12d0b

/be

Comment 5

[Alfred Kayser]

I guess that this bug can be closed now?

Comment 6

[Brendan Eich [:brendan]]

We wait to close until tm has been merged back to m-c.

/be

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/8c7a6ec12d0b

Comment 8

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929