552644 - JM: "Assertion failure: !TRACE_RECORDER(cx) && !wasRecording, at ../jsinterp.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
  for (e in ((function() {
    yield
  })())) return
})()


asserts at js debug shell build on JM tip without -j or -m at Assertion failure: !TRACE_RECORDER(cx) && !wasRecording, at ../jsinterp.cpp:3240

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Occurs in 32-bit js debug shell on Mac 10.6.2.

autoBisect shows this is probably related to the Jaeger work-in-progress...

The first bad revision is:
changeset:   38834:acfaa77d7123
user:        David Anderson <[e-mail]>
date:        Mon Mar 15 16:22:14 2010 -0700
summary:     [JAEGER] Integrated tracing JIT into method JIT, part 1.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This seems to be occurring significantly often in Mac...

But does not seem to occur in Linux 64-bit debug shells.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Assert triggered by uninit variables. These guys had to be moved up further in js_Interpret().

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/eddfe0cebf28

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug552644.js.