Last Comment Bug 666852 - Crash [@ JSContext::generatorFor] or "Assertion failure: fp->isGeneratorFrame(),"
: Crash [@ JSContext::generatorFor] or "Assertion failure: fp->isGeneratorFrame...
Status: VERIFIED FIXED
fixed-in-tracemonkey
: assertion, crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: jsfunfuzz
  Show dependency treegraph
 
Reported: 2011-06-23 23:06 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-10 16:37 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
added missing call to maybeNoteGenerator() (3.64 KB, patch)
2011-06-24 08:28 PDT, Dave Herman [:dherman]
cdleary: review+
Details | Diff | Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-06-23 23:06:23 PDT
(function() {
    [l for (e in yield)]
})()

asserts js debug shell on TM changeset 7dee6c83aaa2 without any CLI arguments at Assertion failure: fp->isGeneratorFrame(), and crashes js opt shell at JSContext::generatorFor

Reproduces after the fix for bug 665286 landed on TM.
Comment 1 Dave Herman [:dherman] 2011-06-24 08:28:16 PDT
Created attachment 541687 [details] [diff] [review]
added missing call to maybeNoteGenerator()

Glah, missed a case where I needed to call maybeNoteGenerator(). There is now one maybeNoteGenerator() call for every GenexpGuard, which is as it should be.

Laziness + mutation, so happy together. :}

Dave
Comment 2 Dave Herman [:dherman] 2011-06-24 11:12:58 PDT
http://hg.mozilla.org/tracemonkey/rev/42430ceb0cbf
Comment 3 Chris Leary [:cdleary] (not checking bugmail) 2011-06-27 11:40:45 PDT
cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/42430ceb0cbf
Comment 4 Gary Kwong [:gkw] [:nth10sd] 2013-01-10 16:37:31 PST
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.

Note You need to log in before you can comment on or make changes to this bug.