603193 - "Assertion failure: flags_ & JSFRAME_HAS_PREVPC,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function g(code) {
  f = Function(code);
  for (a in f()) {}
}
g()
g("function(){}")
g()
g("yield")

asserts js debug shell on TM changeset edb0506b0c23 with -m at Assertion failure: flags_ & JSFRAME_HAS_PREVPC

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   54765:32b049250e03
user:        David Anderson
date:        Mon Oct 04 14:13:33 2010 -0700
summary:     ICs for scripted new (bug 589398, r=luke,dmandelin).

Comment 2

[Jesse Ruderman]

After the fix for bug 595555, the testcase needs a small change:

function g(code) {
  f = Function(code);
  for (a in f()) {}
}
g();
g("(function(){})");
g();
g("yield");

Comment 3

[Luke Wagner [:luke]]

Attachment: fix

This isn't a correctness bug (in release builds), but it was a slight unnecessary slow down.

Comment 4

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/5b757ec177b1

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/5b757ec177b1

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug603193.js.