$ JS_GC_ZEAL=4 jit-test/jit_test.py _DBJ.OBJ/js eif-generator -o Assertion failure: addr % Cell::CellSize == 0, at ../gc/Heap.h:825
Created attachment 634271 [details] [diff] [review] fix Ah, so the problem is that it is totally bogus to copy a generator frame's slot values into the call object when the generator is about to finalized (duh). Rather than trying to dance around to make this work, I'd rather just remove the copy since it only helps preserve debugger values in a presumably rare corner case.
Comment on attachment 634271 [details] [diff] [review] fix This looks fine to me. Jim, I just want to make sure you're okay losing this debugger feature.
The code removal here is definitely a necessary fix, since the values are potentially garbage, so "not losing the debugger feature" is really "adding a debugger feature" which would imply a new bug.
https://hg.mozilla.org/integration/mozilla-inbound/rev/0d94dbf7ae1e and filed bug 768220 as followup.