Assertion failure: baselineFrame->hasReturnValue(), at jit/IonFrames.cpp:480

RESOLVED FIXED in mozilla35

Status

()

--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: decoder, Assigned: shu)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla35
x86_64
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(firefox35 affected)

Details

(Whiteboard: [jsbugmon:update,bisect])

Attachments

(2 attachments)

(Reporter)

Description

4 years ago
The following testcase asserts on mozilla-central revision 6b8da5940f74 (run with --no-threads --fuzzing-safe):


var lfcode = new Array();
lfcode.push = loadFile;
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("\
function testResumptionVal(resumptionVal, turnOffDebugMode) {\
  var g = newGlobal();\
  var dbg = new Debugger;\
  setInterruptCallback(function () {\
    dbg.addDebuggee(g);\
    var frame = dbg.getNewestFrame();\
    frame.onStep = function () {\
      return resumptionVal;\
    };\
    return true;\
  });\
    return g.eval(\"(\" + function f() {\
      invokeInterruptCallback(function (interruptRv) {\
        assertEq(interruptRv, TypedObject.newGlobal == undefined);\
      });\
    } + \")();\");\
}\
assertEq(testResumptionVal({ return: \"not 42\" }), \"not 42\");\
");
function loadFile(lfVarx) {
    try {
        eval("(function() { " + lfVarx + " })();"); 
    } catch (lfVare) { }
}
(Reporter)

Comment 1

4 years ago
Created attachment 8486383 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Updated

4 years ago
status-firefox35: --- → affected
Whiteboard: [jsbugmon:update,bisect]
(Assignee)

Comment 2

4 years ago
Created attachment 8486608 [details] [diff] [review]
Only restore propagatingForcedReturn state in AutoSaveExceptionState if there isn't a new error.

New errors shouldn't be swallowed and should trump existing propagating forced
return behavior.
Attachment #8486608 - Flags: review?(jorendorff)
Comment on attachment 8486608 [details] [diff] [review]
Only restore propagatingForcedReturn state in AutoSaveExceptionState if there isn't a new error.

Review of attachment 8486608 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah, that seems good.
Attachment #8486608 - Flags: review?(jorendorff) → review+
(Assignee)

Comment 4

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/8f515950193c
Assignee: nobody → shu
Status: NEW → ASSIGNED
https://hg.mozilla.org/mozilla-central/rev/8f515950193c
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.