666852 - Crash [@ JSContext::generatorFor] or "Assertion failure: fp->isGeneratorFrame(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    [l for (e in yield)]
})()

asserts js debug shell on TM changeset 7dee6c83aaa2 without any CLI arguments at Assertion failure: fp->isGeneratorFrame(), and crashes js opt shell at JSContext::generatorFor

Reproduces after the fix for bug 665286 landed on TM.

Comment 1

[Dave Herman [:dherman]]

Attachment: added missing call to maybeNoteGenerator()

Glah, missed a case where I needed to call maybeNoteGenerator(). There is now one maybeNoteGenerator() call for every GenexpGuard, which is as it should be.

Laziness + mutation, so happy together. :}

Dave

Comment 2

[Dave Herman [:dherman]]

http://hg.mozilla.org/tracemonkey/rev/42430ceb0cbf

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/42430ceb0cbf

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.