Closed Bug 729797 Opened 10 years ago Closed 10 years ago

IonMonkey: Assertion failure: cx->enumerators == obj, at jsiter.cpp:945

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla13

People

(Reporter: decoder, Assigned: dvander)

References

Details

(Keywords: assertion, testcase)

Attachments

(1 file, 1 obsolete file)

The following testcase asserts on ionmonkey revision 5a04fd69aa09 (run with --ion -n -m), tested on 64 bit:


var patterns = new Array(); 
patterns[0] = '';
test();
function test() {
  for (i in patterns) {
    s = patterns[i];
    status =(test)(s);  
  }
}
Attached patch fix (obsolete) — Splinter Review
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #600297 - Flags: review?(luke)
Comment on attachment 600297 [details] [diff] [review]
fix

(since I'm new here) nice choice on naming it "IonActivation"

>+    // We need to close all iterators that are open on the stack.
>+    while (cx->enumerators != cx->runtime->ionActivation->savedEnumerators()) {
>+        Value v = cx->getPendingException();
>+        cx->clearPendingException();
>+        if (js_CloseIterator(cx, cx->enumerators))
>+            cx->setPendingException(v);
>+    }

I was wondering if we can't factor out this exception-play, either into js_CloseIterator, if there are some callers which don't want that exception behavior, into a function that calls js_CloseIterator called by here and js::Interpret.  To minimize patch burden, perhaps this factoring could be landed as a separate patch on m-c?  (If you agree and want to do such a patch, can you un-JS_FRIEND_API js_ValueToIterator/js_CloseIterator?)
Attached patch v2Splinter Review
Attachment #600297 - Attachment is obsolete: true
Attachment #600591 - Flags: review?(luke)
Attachment #600297 - Flags: review?(luke)
Comment on attachment 600591 [details] [diff] [review]
v2

Righton
Attachment #600591 - Flags: review?(luke) → review+
https://hg.mozilla.org/mozilla-central/rev/aec23eb06a3e
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla13
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.