1064844 - Assertion failure: baselineFrame->hasReturnValue(), at jit/IonFrames.cpp:480

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 6b8da5940f74 (run with --no-threads --fuzzing-safe):


var lfcode = new Array();
lfcode.push = loadFile;
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("");
lfcode.push("\
function testResumptionVal(resumptionVal, turnOffDebugMode) {\
  var g = newGlobal();\
  var dbg = new Debugger;\
  setInterruptCallback(function () {\
    dbg.addDebuggee(g);\
    var frame = dbg.getNewestFrame();\
    frame.onStep = function () {\
      return resumptionVal;\
    };\
    return true;\
  });\
    return g.eval(\"(\" + function f() {\
      invokeInterruptCallback(function (interruptRv) {\
        assertEq(interruptRv, TypedObject.newGlobal == undefined);\
      });\
    } + \")();\");\
}\
assertEq(testResumptionVal({ return: \"not 42\" }), \"not 42\");\
");
function loadFile(lfVarx) {
    try {
        eval("(function() { " + lfVarx + " })();"); 
    } catch (lfVare) { }
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Shu-yu Guo [:shu]]

Attachment: Only restore propagatingForcedReturn state in AutoSaveExceptionState if there isn't a new error.

New errors shouldn't be swallowed and should trump existing propagating forced
return behavior.

Comment 3

[Jason Orendorff [:jorendorff]]

Comment on attachment 8486608 [details] [diff] [review]
Only restore propagatingForcedReturn state in AutoSaveExceptionState if there isn't a new error.

Review of attachment 8486608 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah, that seems good.

Comment 4

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8f515950193c

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/8f515950193c