TI: "Assertion failure: JSOp(*yieldpc) == JSOP_YIELD," with trap

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
Created attachment 534379 [details]
stack

f = (function() {
  let x;
  yield
})
trap(f, 6, undefined);
for (a in f())
  (function() {})()

asserts js debug shell on JM changeset d37ec0c318d6 with -d at Assertion failure: JSOp(*yieldpc) == JSOP_YIELD,
(Reporter)

Comment 1

7 years ago
Tested with a 32-bit shell in 64-bit Ubuntu 11.04.
(Reporter)

Comment 2

7 years ago
js> f = (function() {
  let x;
  yield
})
(function () {var x;yield;})
js> dis(f)
flags: LAMBDA NULL_CLOSURE
off     op
-----   --
00000:  generator
main:
00001:  getlocal 0
00004:  pop
00005:  push
00006:  yield        <-- trap goes here
00007:  pop
00008:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:    1     1 [   1] newline 
  1:    2     1 [   0] decl     offset 0
  3:    2     5 [   4] newline 

js> trap(f, 6, undefined);
js> for (a in f())
  (function() {})()
Assertion failure: JSOp(*yieldpc) == JSOP_YIELD,
Assert is bogus in the presence of a trap.  Is it possible to trap a JSOP_YIELD?

http://hg.mozilla.org/projects/jaegermonkey/rev/c3ed353baad4
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.