776314 - "Assertion failure: src->length() > 0 && chars[0] == '(',"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

disassemble(eval(("(function(){(a for each (e in b));})")));

asserts js debug shell on m-c changeset defbe00ca091 without any CLI arguments at Assertion failure: src->length() > 0 && chars[0] == '(',

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   99950:e080642175e6
user:        Benjamin Peterson
date:        Fri Jul 20 20:17:38 2012 +0200
summary:     Bug 761723 - Save script sources to implement Function.prototype.toString. r=jorendorff,njn,jimb,jst,Ms2ger

Comment 2

[:Benjamin Peterson]

What do people think toSource() of a generator expression should be?

Comment 4

[:Benjamin Peterson]

Attachment: add an generator expression flag to scripts

Comment 5

[:Benjamin Peterson]

Attachment: stub out genexp toSource calls

Comment 6

[Luke Wagner [:luke]]

Comment on attachment 645169 [details] [diff] [review]
stub out genexp toSource calls

>+    if (isInterpreted() && script()->isGeneratorExp) {
>+        if ((!bodyOnly && !out.append("function genexp() {")) ||
>+            !out.append("\n    [generator expression]\n") ||
>+            (!bodyOnly && !out.append("}")))
>+            return NULL;
>+        return out.finishString();

Multi-line conditional needs braced then-branch.

Comment 7

[:Benjamin Peterson]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f939ff2f29fb
https://hg.mozilla.org/integration/mozilla-inbound/rev/08c6cc749ee6

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/f939ff2f29fb
https://hg.mozilla.org/mozilla-central/rev/08c6cc749ee6

Comment 9

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929