The following testcase asserts on mozilla-central revision 83aa31ec53d9 (no options required): gczeal(4,1); var iterable = { persistedProp: 17 }; var keys = ["foo", "bar", "baz"]; var vals = [6, 5, 14]; iterable.__iterator__ = function(keysOnly) { for (var i = 0; i < keys.length; i++) yield [keys[i], vals[i]]; }; var it = Iterator(iterable); while (true) { var nextVal = it.next(); }

Marked s-s until investigated because it's GC-related.

JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/3efe3f3d2c25 user: Jan de Mooij date: Wed Jun 19 19:10:04 2013 +0200 summary: Bug 882111 - Don't push an interpreter frame when calling into the JITs. r=djvj This iteration took 333.917 seconds to run.

jandem, is bug 882111 likely related?

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #4) > jandem, is bug 882111 likely related? Totally, I knew it was bug 882111 when I saw the title. Floating generator frames are a pain. I will look into this soon.

Need a pre-barrier when writing to the generator's stack.

(The patch also removes an outdated comment: we no longer push generators back on the stack after they've been copied to the heap.)

Comment on attachment 767117 [details] [diff] [review] Patch Review of attachment 767117 [details] [diff] [review]: ----------------------------------------------------------------- r=me ::: js/src/jsiter.cpp @@ +1562,1 @@ > gen->regs.sp[-1] = arg; I think we probably also need a post barrier after the write. HeapValue::writeBarrierPost(cx->runtime, gen->regs.sp[-1], &gen->regs.sp[-1]);

Comment on attachment 767117 [details] [diff] [review] Patch [Approval Request Comment] Bug caused by (feature/regressing bug #): Bug 882111 User impact if declined: Crashes, security bugs Testing completed (on m-c, etc.): On m-i Risk to taking this patch (and alternatives if risky): Very low String or IDL/UUID changes made by this patch: None

JSBugMon: This bug has been automatically verified fixed.