583124 - JM: jsreftest assert on js1_7\geniter\unreachable-yield.js

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Mandelin [:dmandelin]]

Assertion failure: uintN(gen->savedRegs.sp - fp->slots()) <= fp->script->nslots, at c:/sources/moo/js/src/jsiter.cpp:1295

Comment 1

[David Mandelin [:dmandelin]]

Attachment: Reduced test case

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

This was a regression from tracer integration. The problem is when exiting js_Interpret on JSOP_RETURN you don't know whether or not the top value was popped, because it could either be a partial interpret or a trace exit. So we always re-pushed the rval, regardless of what the inline_return op was (!)

Better solution is to just set a flag when JSOP_RETURN actually executes.

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/89964b93d40d