1060572 - Reloading the debugger w/ ASM.js code crashes the browser

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[(not reading bugmail) Nick Desaulniers [:\n]]

Attachment: test_case.zip

STR:
1. Download attached zip & unzip
2. open wolf3d.html
3. open debugger
4. reload page

Expected:
page reload

Actual:
crash

Crash reports:
FF 34.0:
https://crash-stats.mozilla.com/report/index/31ecd438-b2ba-4f02-a9b6-942202140829
https://crash-stats.mozilla.com/report/index/cf66491c-ee4b-4cf1-b958-eb0c92140829
https://crash-stats.mozilla.com/report/index/f32ca933-0f9e-45de-b8be-e7dab2140829

FF 31.0:
https://crash-stats.mozilla.com/report/index/e0aa8719-975b-49d0-b42a-58c0f2140829

Looks like different reasons for different versions:

FF 34.0:
js::ObjectImpl::setPrivateGCThing(js::gc::Cell*)

FF 31.0:
bool js::HashMap<js::EncapsulatedPtr<JSScript, unsigned long>, js::RelocatablePtr<JSObject>, js::DefaultHasher<js::EncapsulatedPtr<JSScript, unsigned long> >, js::RuntimeAllocPolicy>::relookupOrAdd<JS::Handle<JSScript*> const&, JSObject* const&>(js::de...

Affects 31+ OSX.

Comment 1

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

From glancing at the stacks, I don't think this has to do with source maps. Does this not crash for you when you remove the //# sourceMappingURL pragma?

Comment 2

[(not reading bugmail) Nick Desaulniers [:\n]]

If I remove the sourceMappingURL pragma, FF still crashes with the same STR.

Comment 3

[Luke Wagner [:luke]]

Looks like a null pointer somewhere in the debugger code.

Comment 4

[James Long (:jlongster)]

I actually just hit this while working on bug 905700. Whenever the debugger sends the form of a SourceActor to a client, it is now sending `source.introductionScript.source.url` (if it exists) to give the client that information. 

I get a crash sometimes when it's trying to wrap the JSScript with a Debugger.Script when getting the `introductionScript`. Here's my crash: https://gist.githubusercontent.com/jlongster/6ff774a5b00e04204b35/raw/0f655db330c9c98f0e22879bd37f7234d8569d66/gistfile1.txt

Hopefully we can fix this soon, as my work is blocked on it.

Comment 5

[Shu-yu Guo [:shu]]

Attachment: Skip inner asm.js functions in D.S.p.getChildScripts.

There's a second bug here that this patch doesn't fix: off-thread parsing a
script will always compile it in non-debug mode. This is hard to fix in the
current world, but is trivial once 1032869 lands.

Comment 6

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8988fac69d4b

Comment 7

[Ekanan Ketunuti]

https://hg.mozilla.org/mozilla-central/rev/8988fac69d4b

Comment 8

[Jim Blandy :jimb]

I gather that since I've approved the patch, the needinfo can be cleared.