Note: There are a few cases of duplicates in user autocompletion which are being worked on.

Crash [@ JSContext::generatorFor] or "Assertion failure: fp->isGeneratorFrame(),"

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
6 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, crash, testcase})

Trunk
x86
Linux
assertion, crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey, crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
(function() {
    [l for (e in yield)]
})()

asserts js debug shell on TM changeset 7dee6c83aaa2 without any CLI arguments at Assertion failure: fp->isGeneratorFrame(), and crashes js opt shell at JSContext::generatorFor

Reproduces after the fix for bug 665286 landed on TM.
Created attachment 541687 [details] [diff] [review]
added missing call to maybeNoteGenerator()

Glah, missed a case where I needed to call maybeNoteGenerator(). There is now one maybeNoteGenerator() call for every GenexpGuard, which is as it should be.

Laziness + mutation, so happy together. :}

Dave
Attachment #541687 - Flags: review?(cdleary)
Attachment #541687 - Flags: review?(cdleary) → review+
http://hg.mozilla.org/tracemonkey/rev/42430ceb0cbf
Whiteboard: fixed-in-tracemonkey
cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/42430ceb0cbf
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Flags: in-testsuite+
(Reporter)

Comment 4

5 years ago
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.