601396 - TM: "Assertion failure: isFunctionFrame() && !isEvalFrame(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function(){
  eval("\
    for each(let a in['A','A','A','A','A','A','A','A']) {\
      L:for each(let b in a) {\
        break L\
      }\
    }\
  ")
})()

asserts js debug shell on TM changeset 0230a9e80c1f with -j at Assertion failure: isFunctionFrame() && !isEvalFrame(),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   53120:1b55ec0c7aee
user:        David Anderson
date:        Tue Sep 07 22:52:15 2010 -0700
summary:     Fix various bugs in tracer integration (bug 593532, r=dmandelin).

Comment 2

[Luke Wagner [:luke]]

I am unable to reproduce this with any combination of jit flags or by increasing the size of the array (which already seems long enough).

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   55739:0aa283c6294f
user:        David Anderson
date:        Fri Oct 22 16:27:28 2010 -0700
summary:     Trace returning from JSOP_STOP with callDepth=0 (bug 606083, r=billm).

Comment 4

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929