Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Description • 15 years ago

for (var a = 0; a < 7; ++a) {
    if (a == 1) {
        Iterator()
    }
}

assert js debug shell on JM tip with -m and -j at Assertion failure: what do i do, at ../methodjit/Stubs.cpp:3629

	David Anderson [:dvander] - inactive, e-mail if emergency
	Comment 1 • 15 years ago

Awesome, I've been waiting for a test case on this.

	Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Comment 2 • 15 years ago

(function() {
  for each(let a in [function() {}, Infinity]) {
    new Array(a)
  }
})()

crashes js opt shell with -m and -j on JM tip at js_CloseIterator

===

Function("\n\
  for (a = 0; a < 3; a++) {\n\
    if (a == 0) {} else {\n\
      __defineSetter__(\"\",1)\n\
    }\n\
  }\n\
")()

crashes js opt shell with -m and -j on JM tip at js_Invoke (64-bit only)

===

(function() {
  try {
    (eval("\
      function() {\
        for each(let y in [0]) {\
          for (var a = 0; a < 9; ++a) {\
            if (a) {\
              this.__defineGetter__(\"\",this)\
            }\
          }\
        }\
      }\
    "))()
  } catch(e) {}
})()

crashes js opt shell with -m and -j on JM tip at js_PutBlockObject (64-bit only)

	Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Comment 3 • 15 years ago

(function() {
  (function g(m, n) {
    if (m = n) {
      return eval("x=this")
    }
    g(m, 1)[[]]
  })()
})()
Function("\
  for (let b in [0]) {\
    for (var k = 0; k < 6; ++k) {\
      if (k == 1) {\
        print(x)\
      }\
    }\
  }\
")()

crashes js opt shell with -m and -j on JM tip at js::jsl_LeaveBlock (64-bit)

	David Anderson [:dvander] - inactive, e-mail if emergency
	Comment 4 • 15 years ago

Awesome test cases. I think this patch covers everything, and closes the last major TODO of tracer integration.

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/d8ed909484f2

Test cases pushed with follow-up commits.

	Christian Holler (:decoder)
	Comment 5 • 12 years ago

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug554580-4.js.