843985 - "Assertion failure: !script->isGenerator,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

for (x in (function() {
    eval("arguments[0]");
    yield;
})())(function() {})

asserts js debug shell on m-c changeset 885cde564ff3 without any CLI arguments at Assertion failure: !script->isGenerator,

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122445:e3b899354a6f
user:        Brian Hackett
date:        Wed Feb 20 04:54:13 2013 -0700
summary:     Bug 842522 - Don't force construction of arguments objects in the presence of dynamic name accesses, r=luke.

Is bug 842522 a likely regressor?

Comment 2

[Brian Hackett [Laid off!]]

Rolling this in with bug 844048.  This is a separate issue but the fix is small and both were caused by the same cset.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting FIXED by bug 844048 instead. -> VERIFIED because in-testsuite+, the test here has also landed in that bug.