1252109 - Crash [@ DebuggerObject_forceLexicalInitializationByName] or Assertion failure: isAtom(), at vm/String.h:457 with Debugger

Status: RESOLVED DUPLICATE of bug 1246215

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 5e0140b6d118 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --target=i686-pc-linux-gnu --disable-tests --enable-simulator=arm --disable-debug, run with --fuzzing-safe --ion-offthread-compile=off min.js):

 g = newGlobal();
 dbg = new Debugger;
 gw = dbg.addDebuggee(g);
 function evalErrorStr(global, evalString) global.evaluate(evalString)
 assertEq(evalErrorStr(g, "y = 1"), gw.forceLexicalInitializationByName("y"))


Backtrace:

Program received signal SIGSEGV, Segmentation fault.
DebuggerObject_forceLexicalInitializationByName (cx=cx@entry=0xf7a72040, argc=1, vp=0xf4b1a070) at js/src/vm/Debugger.cpp:8067
#0  DebuggerObject_forceLexicalInitializationByName (cx=cx@entry=0xf7a72040, argc=1, vp=0xf4b1a070) at js/src/vm/Debugger.cpp:8067
#1  0x0848d6da in CallJSNative (args=..., native=0x8446320 <DebuggerObject_forceLexicalInitializationByName(JSContext*, unsigned int, JS::Value*)>, cx=0xf7a72040) at js/src/jscntxtinlines.h:235
[...]
#13 main (argc=4, argv=0xffffd8b4, envp=0xffffd8c8) at js/src/shell/js.cpp:7244
eax	0x155	341
ebx	0x9490960	155781472
ecx	0xa98	2712
edx	0x1	1
esi	0xf4d69040	-187264960
edi	0xf4d77a60	-187205024
ebp	0x153	339
esp	0xffffcba0	4294953888
eip	0x8446514 <DebuggerObject_forceLexicalInitializationByName(JSContext*, unsigned int, JS::Value*)+500>
=> 0x8446514 <DebuggerObject_forceLexicalInitializationByName(JSContext*, unsigned int, JS::Value*)+500>:	mov    (%ecx),%ebp
   0x8446516 <DebuggerObject_forceLexicalInitializationByName(JSContext*, unsigned int, JS::Value*)+502>:	mov    %ebp,0x1c(%esp)

Comment 1

[Eric Faust [:efaust]]

Morgan, seems like something you might have been involved with? Can you take a look?

Comment 2

[Morgan Phillips [:mrrrgn]]

Definitely on me. On it.

Comment 3

[Morgan Phillips [:mrrrgn]]

So this bug has already been fixed: http://hg.mozilla.org/integration/mozilla-inbound/rev/c6437b3b18d7 It's not critical, but I can go ahead and request uplift.