564672 - TM: (64-bit) "Assertion failure: !JS_ON_TRACE(cx), at ../jsiter.cpp" with defineGetter, yield

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

__defineGetter__("x", function () {
    yield
})
for each(let x in [new Boolean(false), /x/, x]) {
    for (w in x) {}
}

asserts js debug shell on TM tip with -j at Assertion failure: !JS_ON_TRACE(cx), at ../jsiter.cpp:594

Tested on 64-bit Linux.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This doesn't seem to occur on 32-bit Linux, nor Mac.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(autoBisect.py now works! Hurray, rejoice!)

autoBisect shows this is probably related to bug 558754:

The first bad revision is:
changeset:   41832:b15fd8b568e4
user:        Andreas Gal
date:        Fri May 07 17:52:52 2010 -0700
summary:     fast object iteration (558754, r=brendan, CLOSED TREE).

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this was fixed by bug 565199:

The first good revision is:
changeset:   41876:40260d7634a1
user:        Andreas Gal
date:        Wed May 12 17:14:28 2010 -0400
summary:     Bug 565199 - TM: trace-test failure in testGeneratorDeepBail, x64. r=dvander

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #3)
> autoBisect shows this was fixed by bug 565199:
> 
> The first good revision is:
> changeset:   41876:40260d7634a1
> user:        Andreas Gal
> date:        Wed May 12 17:14:28 2010 -0400
> summary:     Bug 565199 - TM: trace-test failure in testGeneratorDeepBail, x64.
> r=dvander

http://hg.mozilla.org/tracemonkey/rev/40260d7634a1

http://hg.mozilla.org/mozilla-central/rev/40260d7634a1

-> Fixed.