diff --git a/js/src/jit-test/tests/warp/bug1683614.js b/js/src/jit-test/tests/warp/bug1683614.js new file mode 100644 index 000000000000..69fc780c150d --- /dev/null +++ b/js/src/jit-test/tests/warp/bug1683614.js @@ -0,0 +1,14 @@ +// |jit-test| --ion-offthread-compile=off; --ion-full-warmup-threshold=0; --warp-async; --baseline-eager; +// +// The following testcase crashes on mozilla-central revision 20201219-3262affdccf6 (debug build, run with --fuzzing-safe --ion-offthread-compile=off --ion-full-warmup-threshold=0 --warp-async --baseline-eager): +gczeal(9, 8); +function s() { } +new ReadableStream({ + start() { + test(); + } +}); +async function test() { + for (let i17 = 1; i17 <= 30; i17++) + await s(0 + function () { return i17 }); +} \ No newline at end of file diff --git a/js/src/jit/WarpBuilder.cpp b/js/src/jit/WarpBuilder.cpp index 1ca9932ae65d..c06299f5bfa4 100644 --- a/js/src/jit/WarpBuilder.cpp +++ b/js/src/jit/WarpBuilder.cpp @@ -2309,6 +2309,9 @@ bool WarpBuilder::buildSuspend(BytecodeLocation loc, MDefinition* gen, alloc(), genObj, AbstractGeneratorObject::envChainSlot(), current->environmentChain())); + current->add( + MPostWriteBarrier::New(alloc(), genObj, current->environmentChain())); + // GeneratorReturn will return from the method, however to support MIR // generation isn't treated like the end of a block MGeneratorReturn* ret = MGeneratorReturn::New(alloc(), retVal);