908472 - Crash [@ fun_isGenerator] or Assertion failure: isInterpretedLazy() && u.i.s.lazy_, at jsfun.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

[0].some(Function.isGenerator, [].map)

asserts js debug shell on m-c changeset d58fc624899c without any CLI arguments at Assertion failure: isInterpretedLazy() && u.i.s.lazy_, at jsfun.h

Comment 1

[Till Schneidereit [:till]]

Urgh. JSFunction::generatorKind doesn't work for self-hosted lazy functions, only for lazy-parsed ones.

Shouldn't be too hard to fix, though.

Comment 2

[Till Schneidereit [:till]]

Attachment: make JSFunction::generatorKind() treat lazy self-hosted functions as non-generators.

As discussed on IRC, this patch makes JSFunction::generatorKind always return js::NotGenerator for lazy self-hosted functions.

To ensure that it doesn't incorrectly do so, JSRuntime::cloneSelfHostedFunctionScript asserts that the cloned function isn't a generator.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/26d92ba69fe6
user:        Andy Wingo
date:        Tue Aug 20 11:03:24 2013 +0200
summary:     Bug 666399 - New Harmony syntax for generators. r=Waldo

Yes, bug 666399 seems to be the regressor.

Comment 4

[Andy Wingo [:wingo]]

Comment on attachment 794313 [details] [diff] [review]
make JSFunction::generatorKind() treat lazy self-hosted functions as non-generators.

Review of attachment 794313 [details] [diff] [review]:
-----------------------------------------------------------------

Yes, it looks like I misunderstood the interactions between lazyscript, script, and self-hosted functions.  Thanks for looking at this; patch looks good to me!

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: opt stack

This also crashes js opt shell at fun_isGenerator, likely a null deref though.

Comment 6

[Jeff Walden [:Waldo]]

Comment on attachment 794313 [details] [diff] [review]
make JSFunction::generatorKind() treat lazy self-hosted functions as non-generators.

Review of attachment 794313 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsfun.h
@@ +290,5 @@
> +        if (hasScript())
> +            return nonLazyScript()->generatorKind();
> +        js::LazyScript *lazy = lazyScriptOrNull();
> +        if (lazy)
> +            return lazy->generatorKind();

if (js::LazyScript *lazy = lazyScriptOrNull())
    return lazy->generatorKind();

is a little more compact.

::: js/src/vm/SelfHosting.cpp
@@ +936,5 @@
>          return false;
>  
>      RootedFunction sourceFun(cx, &funVal.toObject().as<JSFunction>());
> +    // JSFunction::generatorKind can't handle lazy self-hosted function, so we make sure there
> +    // aren't any.

"functions"

Comment 7

[Till Schneidereit [:till]]

Pushed with nits addressed:
https://hg.mozilla.org/integration/mozilla-inbound/rev/799ed2cf9e82

Comment 8

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/799ed2cf9e82