diff --git a/js/src/vm/GeneratorObject.cpp b/js/src/vm/GeneratorObject.cpp index 082e382663..f0718c0f86 100644 --- a/js/src/vm/GeneratorObject.cpp +++ b/js/src/vm/GeneratorObject.cpp @@ -179,6 +179,8 @@ GeneratorObject::resume(JSContext* cx, InterpreterActivation& activation, { Rooted genObj(cx, &obj->as()); MOZ_ASSERT(genObj->isSuspended()); + // See comment in InterpreterStack::resumeGeneratorCallFrame + MOZ_ASSERT_IF(genObj->isConstructing(), genObj->is()); RootedFunction callee(cx, &genObj->callee()); RootedValue newTarget(cx, genObj->newTarget()); diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h index 9114a6a79e..5f66159c2c 100644 --- a/js/src/vm/Stack-inl.h +++ b/js/src/vm/Stack-inl.h @@ -351,7 +351,10 @@ InterpreterStack::resumeGeneratorCallFrame(JSContext* cx, InterpreterRegs& regs, constructing = MaybeConstruct(newTarget.isObject()); MOZ_ASSERT_IF(constructing, callee->isConstructor()); } else { - MOZ_ASSERT(!callee->isConstructor()); + // We should really be doing MOZ_ASSERT(!callee->isConstructor()) here. + // However, the GeneratorObject only stores the callee as-is, which in the case of a lambda generator + // (i.e. a |new GeneratorFunction(...)| or derieved generator class) is still flagged as a constructor. + // Instead, we check for the correct state in GeneratorObject::resume. } // Include callee, |this|, and maybe |new.target|