Bug 485022 - TM: Assertion failure: JS_ON_TRACE(cx), at ../jsarray.cpp. r=mrbkap

js/src/imacros.c.out

@@ -624,7 +624,7 @@ static struct {
     },
 };
 static struct {
-    jsbytecode custom_iter_next[10];
+    jsbytecode custom_iter_next[12];
     jsbytecode native_iter_next[12];
 } nextiter_imacros = {
     {
@@ -632,8 +632,10 @@ static struct {
 /* 1*/  JSOP_DUP,
 /* 2*/  JSOP_CALLPROP, 0, COMMON_ATOM_INDEX(next),
 /* 5*/  JSOP_CALL, 0, 0,
-/* 8*/  JSOP_TRUE,
-/* 9*/  JSOP_STOP,
+/* 8*/  JSOP_DUP,
+/* 9*/  JSOP_HOLE,
+/*10*/  JSOP_STRICTNE,
+/*11*/  JSOP_STOP,
     },
     {
 /* 0*/  JSOP_POP,

js/src/imacros.jsasm

@@ -674,7 +674,9 @@
         dup                                         # iterobj iterobj
         callprop next                               # iterobj fun iterobj
         call 0                                      # iterobj nextval
-        true                                        # iterobj nextval true
+        dup                                         # iterobj nextval? nextval?
+        hole                                        # iterobj nextval? nextval? hole
+        strictne                                    # iterobj nextval? boolean
         stop
     .end
 

js/src/jsbuiltins.h

@@ -182,6 +182,7 @@ struct JSTraceableNative {
 #define _JS_CTYPE_CALLEE            _JS_CTYPE(JSObject *,             _JS_PTR,"f","",  INFALLIBLE)
 #define _JS_CTYPE_CALLEE_PROTOTYPE  _JS_CTYPE(JSObject *,             _JS_PTR,"p","",  INFALLIBLE)
 #define _JS_CTYPE_PC                _JS_CTYPE(jsbytecode *,           _JS_PTR,"P", "", INFALLIBLE)
+#define _JS_CTYPE_JSVALPTR          _JS_CTYPE(jsval *,                _JS_PTR,"P", "", INFALLIBLE)
 #define _JS_CTYPE_JSVAL             _JS_JSVAL_CTYPE(                  _JS_PTR, "","v", INFALLIBLE)
 #define _JS_CTYPE_JSVAL_RETRY       _JS_JSVAL_CTYPE(                  _JS_PTR, --, --, FAIL_COOKIE)
 #define _JS_CTYPE_JSVAL_FAIL        _JS_JSVAL_CTYPE(                  _JS_PTR, --, --, FAIL_STATUS)

js/src/jsinterp.cpp

@@ -5036,8 +5036,23 @@ js_Interpret(JSContext *cx)
                     }
 #endif
                     regs.sp = vp + 1;
-                    if (!ok)
-                        goto error;
+                    if (!ok) {
+                        /*
+                         * If we are executing the JSOP_NEXTITER imacro and a Stopiteration
+                         * exception is raised, transform it into a JSVAL_HOLE return value.
+                         * The tracer generates equivalent code by calling CatchStopIteration_tn.
+                         */
+                        if (fp->imacpc && *fp->imacpc == JSOP_NEXTITER &&
+                            cx->throwing && js_ValueIsStopIteration(cx->exception)) {
+                            // pc may point to JSOP_DUP here due to bug 474854.
+                            JS_ASSERT(*regs.pc == JSOP_CALL || *regs.pc == JSOP_DUP);
+                            cx->throwing = JS_FALSE;
+                            cx->exception = JSVAL_VOID;
+                            regs.sp[-1] = JSVAL_HOLE;
+                        } else {
+                            goto error;
+                        }
+                    }
                     TRACE_0(FastNativeCallComplete);
                     goto end_call;
                 }

js/src/jstracer.cpp

@@ -7755,6 +7755,21 @@ TraceRecorder::record_JSOP_APPLY()
     return call_imacro(call_imacro_table[argc]);
 }
 
+static JSBool FASTCALL
+CatchStopIteration_tn(JSContext* cx, JSBool ok, jsval* vp)
+{
+    if (!ok && cx->throwing && js_ValueIsStopIteration(cx->exception)) {
+        cx->throwing = JS_FALSE;
+        cx->exception = JSVAL_VOID;
+        *vp = JSVAL_HOLE;
+        return JS_TRUE;
+    }
+    return ok;
+}
+
+JS_DEFINE_TRCINFO_1(CatchStopIteration_tn,
+    (3, (static, BOOL, CatchStopIteration_tn, CONTEXT, BOOL, JSVALPTR, 0, 0)))
+
 JS_REQUIRES_STACK bool
 TraceRecorder::record_FastNativeCallComplete()
 {
@@ -7788,6 +7803,16 @@ TraceRecorder::record_FastNativeCallComplete()
         if (pendingTraceableNative == generatedTraceableNative) {
             LIns* ok_ins = v_ins;
 
+            /*
+             * Custom implementations of Iterator.next() throw a StopIteration exception.
+             * Catch and clear it and set the return value to JSVAL_HOLE in this case.
+             */
+            if (uintptr_t(cx->fp->regs->pc - nextiter_imacros.custom_iter_next) <
+                sizeof(nextiter_imacros.custom_iter_next)) {
+                LIns* args[] = { invokevp_ins, ok_ins, cx_ins }; /* reverse order */
+                ok_ins = lir->insCall(&CatchStopIteration_tn_ci, args);
+            }
+
             /*
              * If we run a generic traceable native, the return value is in the argument
              * vector. The actual return value of the fast native is a JSBool indicated
@@ -8382,10 +8407,11 @@ TraceRecorder::record_JSOP_NEXTITER()
     jsval& iterobj_val = stackval(-2);
     if (JSVAL_IS_PRIMITIVE(iterobj_val))
         ABORT_TRACE("for-in on a primitive value");
-
+    JSObject* iterobj = JSVAL_TO_OBJECT(iterobj_val);
+    JSClass* clasp = STOBJ_GET_CLASS(iterobj);
     LIns* iterobj_ins = get(&iterobj_val);
-    if (guardClass(JSVAL_TO_OBJECT(iterobj_val), iterobj_ins, &js_IteratorClass,
-                   snapshot(BRANCH_EXIT))) {
+    if (clasp == &js_IteratorClass || clasp == &js_GeneratorClass) {
+        guardClass(iterobj, iterobj_ins, clasp, snapshot(BRANCH_EXIT));
         return call_imacro(nextiter_imacros.native_iter_next);
     }
     return call_imacro(nextiter_imacros.custom_iter_next);