Last Comment Bug 678090 - Assertion failure: spoff == js_ReconstructStackDepth(cx_, fp_->script(), pc_), at vm/Stack.cpp:1012
: Assertion failure: spoff == js_ReconstructStackDepth(cx_, fp_->script(), pc_)...
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
-- critical (vote)
: mozilla9
Assigned To: Luke Wagner [:luke]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz
  Show dependency treegraph
Reported: 2011-08-10 16:18 PDT by Christian Holler (:decoder)
Modified: 2013-01-19 14:02 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

fix and test (1.74 KB, patch)
2011-08-11 17:03 PDT, Luke Wagner [:luke]
dvander: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2011-08-10 16:18:07 PDT
The following code asserts on mozilla-inbound (revision 609f37c36bd7, options -j -m -a):

function toSource(arr) {
  for (i=0; i<len; i++) {}
function test() {
  function gen() {
    var c = test;
    try {
      yield c;
    } finally {
  var iter = gen();
  for (i in iter) {
Comment 1 User image Luke Wagner [:luke] 2011-08-11 17:03:49 PDT
Created attachment 552545 [details] [diff] [review]
fix and test

Looks like there is a bug where the mjit's exception handling doesn't update the current pc to match the updated sp when closing open iterators (which is observable since this can run finalizers).  I suspect this is debug-only failure; I can't think of how it would manifest a real problem.
Comment 3 User image Marco Bonardo [::mak] 2011-08-19 03:20:53 PDT

the bug number in the changeset is wrong
Comment 4 User image Christian Holler (:decoder) 2013-01-19 14:02:07 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.