Comment 1 Brian Hackett (:bhackett) 2011-11-28 17:48:50 PST

I can't repro on the named revision and architecture.

Comment 2 Gary Kwong [:gkw] [:nth10sd] 2011-11-28 18:10:51 PST

(In reply to Brian Hackett (:bhackett) from comment #1)
> I can't repro on the named revision and architecture.

I can definitely still reproduce this on a 32-bit debug shell on JM rev 1e8c03ba91d0 without any CLI flags.

Comment 3 Gary Kwong [:gkw] [:nth10sd] 2011-12-01 14:28:03 PST

> I can definitely still reproduce this on a 32-bit debug shell on JM rev
> 1e8c03ba91d0 without any CLI flags.

There was some offline discussion about this being possibly platform and configuration-specific and being potentially fixed by bug 692274.

Comment 4 Gary Kwong [:gkw] [:nth10sd] 2011-12-07 15:37:51 PST

> There was some offline discussion about this being possibly platform and
> configuration-specific and being potentially fixed by bug 692274.

This still reproduces with the patch in comment 35 in bug 692274 applied on m-c rev 7ab478082ca7. Testing m-c because ObjShrink has landed on m-c.

Luke, any ideas on why this still occurs? (when Brian and I last spoke, this doesn't really seem directly related to ObjShrink)

Comment 5 Luke Wagner [:luke] 2011-12-07 15:48:26 PST

(In reply to Gary Kwong [:gkw, :nth10sd] from comment #4)
> Luke, any ideas on why this still occurs? (when Brian and I last spoke, this
> doesn't really seem directly related to ObjShrink)

Yeah, it's ObjShrink: 'priv' is a stale stack frame stored in the generator object, this code should use the live frame (on the stack), i.e., 'fp'.

Comment 6 Luke Wagner [:luke] 2011-12-07 15:51:29 PST

Created attachment 579881 [details] [diff] [review]
fix

Comment 7 Gary Kwong [:gkw] [:nth10sd] 2011-12-08 11:40:34 PST

(In reply to Luke Wagner [:luke] from comment #6)
> Created attachment 579881 [details] [diff] [review]
> fix

(setting assignee to Luke since he has an r+ patch - ready for checkin!)

Comment 8 Brian Hackett (:bhackett) 2011-12-12 18:38:29 PST

*** Bug 709929 has been marked as a duplicate of this bug. ***

Comment 9 Gary Kwong [:gkw] [:nth10sd] 2011-12-12 18:53:07 PST

The testcase in bug 709929 should also be landed.

Comment 10 Luke Wagner [:luke] 2011-12-13 09:48:18 PST

Righto.  Will land when m-i kerfuffle clears up; sorry for not landing earlier.

Comment 11 Gary Kwong [:gkw] [:nth10sd] 2011-12-14 16:05:26 PST

(In reply to Gary Kwong [:gkw, :nth10sd] from comment #9)
> The testcase in bug 709929 should also be landed.

Here's another testcase which crashes debug shell that is fixed by the patch here:

f = (function() {
    function shapeyConstructor(qvhvyl) {
        Object.defineProperty(qvhvyl, "", ({
            e: true
        }));
        gc();
    }
    for each(let x in [Number, Number, new Number]) {
        try {
            let g = shapeyConstructor(x);
            with({}) {
                with([]) yield
                }
            } catch (e) {
            }
        }
    })
for (i in f()) {}

Comment 12 Luke Wagner [:luke] 2011-12-15 13:55:23 PST

https://hg.mozilla.org/integration/mozilla-inbound/rev/ebfc6414c4dc

Comment 13 :Ms2ger (⌚ UTC+1/+2) 2011-12-16 05:41:49 PST

https://hg.mozilla.org/mozilla-central/rev/ebfc6414c4dc

Comment 14 Gary Kwong [:gkw] [:nth10sd] 2012-12-13 17:06:12 PST

A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.