Closed Bug 583124 Opened 11 years ago Closed 11 years ago

JM: jsreftest assert on js1_7\geniter\unreachable-yield.js

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: dmandelin, Assigned: dvander)

References

Details

Attachments

(1 file)

Assertion failure: uintN(gen->savedRegs.sp - fp->slots()) <= fp->script->nslots, at c:/sources/moo/js/src/jsiter.cpp:1295
Attached file Reduced test case
Assignee: dmandelin → dvander
This was a regression from tracer integration. The problem is when exiting js_Interpret on JSOP_RETURN you don't know whether or not the top value was popped, because it could either be a partial interpret or a trace exit. So we always re-pushed the rval, regardless of what the inline_return op was (!)

Better solution is to just set a flag when JSOP_RETURN actually executes.

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/89964b93d40d
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Duplicate of this bug: 580684
You need to log in before you can comment on or make changes to this bug.