659337 - TI: "Assertion failure: JOF_TYPE(cs->format) == JOF_ATOM," with trap

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

f = Function("for (x = 0; x < 6; x++) { gc() }");
dis(f)
trap(f, 23, '');
f()

asserts js debug shell on JM changeset 29f08848d96c with -m, -a, -d and -n at Assertion failure: JOF_TYPE(cs->format) == JOF_ATOM,

Woo-hoo! My 1,000th bug!

===

flags: LAMBDA
off     op
-----   --
main:
00000:  bindname "x"
00003:  zero
00004:  setname "x"
00007:  pop
00008:  goto 27 (19)
00011:  trace 0
00014:  callname "gc"
00019:  call 0
00022:  pop
00023:  nameinc "x"        <-- trap goes here
00026:  pop
00027:  name "x"
00032:  int8 6
00034:  lt
00035:  ifne 11 (-24)
00038:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:    1     7 [   7] for      cond 19 update 15 tail 27
  4:    1    11 [   4] while    offset 24
  6:    1    19 [   8] xdelta  
  7:    1    19 [   0] pcbase   offset 5

Comment 1

[Brian Hackett [Laid off!]]

Fix a few places we needed to untrap at when rejoining into the interpreter.

http://hg.mozilla.org/projects/jaegermonkey/rev/0d3bcf8e0bb8