Closed Bug 564672 Opened 15 years ago Closed 14 years ago

TM: (64-bit) "Assertion failure: !JS_ON_TRACE(cx), at ../jsiter.cpp" with defineGetter, yield

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)

__defineGetter__("x", function () { yield }) for each(let x in [new Boolean(false), /x/, x]) { for (w in x) {} } asserts js debug shell on TM tip with -j at Assertion failure: !JS_ON_TRACE(cx), at ../jsiter.cpp:594 Tested on 64-bit Linux.
This doesn't seem to occur on 32-bit Linux, nor Mac.
Summary: TM: "Assertion failure: !JS_ON_TRACE(cx), at ../jsiter.cpp" with defineGetter, yield → TM: (64-bit) "Assertion failure: !JS_ON_TRACE(cx), at ../jsiter.cpp" with defineGetter, yield
(autoBisect.py now works! Hurray, rejoice!) autoBisect shows this is probably related to bug 558754: The first bad revision is: changeset: 41832:b15fd8b568e4 user: Andreas Gal date: Fri May 07 17:52:52 2010 -0700 summary: fast object iteration (558754, r=brendan, CLOSED TREE).
autoBisect shows this was fixed by bug 565199: The first good revision is: changeset: 41876:40260d7634a1 user: Andreas Gal date: Wed May 12 17:14:28 2010 -0400 summary: Bug 565199 - TM: trace-test failure in testGeneratorDeepBail, x64. r=dvander
Whiteboard: fixed-in-tracemonkey
(In reply to comment #3) > autoBisect shows this was fixed by bug 565199: > > The first good revision is: > changeset: 41876:40260d7634a1 > user: Andreas Gal > date: Wed May 12 17:14:28 2010 -0400 > summary: Bug 565199 - TM: trace-test failure in testGeneratorDeepBail, x64. > r=dvander http://hg.mozilla.org/tracemonkey/rev/40260d7634a1 http://hg.mozilla.org/mozilla-central/rev/40260d7634a1 -> Fixed.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.