Last Comment Bug 759904 - Crash [@ JSContext::generatorFor] or "Assertion failure: fp->isGeneratorFrame(),"
: Crash [@ JSContext::generatorFor] or "Assertion failure: fp->isGeneratorFrame...
Status: VERIFIED FIXED
js-triage-done
: assertion, crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: mozilla15
Assigned To: :Benjamin Peterson
:
Mentors:
: 760401 (view as bug list)
Depends on:
Blocks: jsfunfuzz harmony:defaults
  Show dependency treegraph
 
Reported: 2012-05-30 14:25 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-06-27 11:18 PDT (History)
6 users (show)
gary: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected
fixed
unaffected


Attachments
stack (4.91 KB, text/plain)
2012-05-30 14:25 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
fix (1014 bytes, patch)
2012-05-30 14:50 PDT, :Benjamin Peterson
jorendorff: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-05-30 14:25:30 PDT
Created attachment 628484 [details]
stack

function a(b = (function() {})) {
    yield
}
a()

asserts js debug shell on m-c changeset f28d1ec8bd33 without any CLI arguments at Assertion failure: fp->isGeneratorFrame(), and crashes js opt shell at JSContext::generatorFor

Seems to be a null crash, so feel free to open up if not s-s.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   95044:699a613bf616
user:        Benjamin Peterson
date:        Sat May 26 09:33:53 2012 -0400
summary:     Bug 757676 - Implement JS default parameters. r=jorendorff
Comment 1 Jason Orendorff [:jorendorff] 2012-05-30 14:39:38 PDT
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x000000010008af36 in JSContext::generatorFor (this=0x100c154f0, fp=0x1018000b8) at /Users/jorendorff/dev/mi/js/src/jscntxt.cpp:1087
1087	    JS_ASSERT(fp->isGeneratorFrame());
(gdb) call js_DumpPC(this)
loc   line  op
----- ----  --
main:
    00000:   2  actualsfilled 0
    00003:   2  tableswitch defaultOffset 26 low 0 high 0
	0: 17
    00020:   2  lambda (function () {})
    00025:   2  setarg 0
    00028:   2  pop
    00029:   3  undefined
--> 00030:   3  yield
    00031:   3  pop
    00032:   3  stop
$1 = 1

There ought to be a JSOP_GENERATOR opcode in the prologue.
Comment 2 :Benjamin Peterson 2012-05-30 14:50:58 PDT
Created attachment 628489 [details] [diff] [review]
fix

I forgot to call endBody on GenexpGuard.
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2012-05-31 10:58:04 PDT
http://hg.mozilla.org/integration/mozilla-inbound/rev/71e016e251a7
Comment 4 Jan de Mooij [:jandem] 2012-06-01 04:37:34 PDT
*** Bug 760401 has been marked as a duplicate of this bug. ***
Comment 5 Ed Morley [:emorley] 2012-06-01 08:40:42 PDT
https://hg.mozilla.org/mozilla-central/rev/71e016e251a7
Comment 6 Christian Holler (:decoder) 2012-06-01 08:55:07 PDT
JSBugMon: This bug has been automatically verified fixed.

Note You need to log in before you can comment on or make changes to this bug.