1066055 - Assertion failure: hasUsableAbstractFramePtr(), at vm/Stack.cpp:1042

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision bc7deafdac4b (run with --fuzzing-safe --no-threads --ion-eager):


l = function(x) { evaluate(x); };
l("0");
l("\
var g = newGlobal();\
var dbg = new g.Debugger(this);\
function callee() {\
  evalInFrame(3, 'var x = 0');\
}\
function caller(code) {\
  callee();\
}\
caller()\
");

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Debugger issue, forwarding to Jason :)

Comment 3

[Shu-yu Guo [:shu]]

This is a bug with the shell's evalInFrame interacting with debug mode OSR. The shell's evalInFrame is going to be removed in bug 1063330, which is blocked on bug 1032869, which is waiting for review.

Hang on tight, I guess.

Comment 4

[Christian Holler (:decoder)]

Let's keep the bug open then and make it depend on bug 1063330, because the fuzzer uses the attached signature to ignore the issue while it's still open.

Comment 5

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 6

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision bbb68df450c2).

Comment 7

[Christian Holler (:decoder)]

Fixed by bug 1063330.