Last Comment Bug 666852 - Crash [@ JSContext::generatorFor] or "Assertion failure: fp->isGeneratorFrame(),"
: Crash [@ JSContext::generatorFor] or "Assertion failure: fp->isGeneratorFrame...
: assertion, crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
-- critical (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz
  Show dependency treegraph
Reported: 2011-06-23 23:06 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-10 16:37 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

added missing call to maybeNoteGenerator() (3.64 KB, patch)
2011-06-24 08:28 PDT, Dave Herman [:dherman]
cdleary: review+
Details | Diff | Splinter Review

Description User image Gary Kwong [:gkw] [:nth10sd] 2011-06-23 23:06:23 PDT
(function() {
    [l for (e in yield)]

asserts js debug shell on TM changeset 7dee6c83aaa2 without any CLI arguments at Assertion failure: fp->isGeneratorFrame(), and crashes js opt shell at JSContext::generatorFor

Reproduces after the fix for bug 665286 landed on TM.
Comment 1 User image Dave Herman [:dherman] 2011-06-24 08:28:16 PDT
Created attachment 541687 [details] [diff] [review]
added missing call to maybeNoteGenerator()

Glah, missed a case where I needed to call maybeNoteGenerator(). There is now one maybeNoteGenerator() call for every GenexpGuard, which is as it should be.

Laziness + mutation, so happy together. :}

Comment 2 User image Dave Herman [:dherman] 2011-06-24 11:12:58 PDT
Comment 3 User image Chris Leary [:cdleary] (not checking bugmail) 2011-06-27 11:40:45 PDT
cdleary-bot mozilla-central merge info:
Comment 4 User image Gary Kwong [:gkw] [:nth10sd] 2013-01-10 16:37:31 PST
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.

Note You need to log in before you can comment on or make changes to this bug.