1501724 - Assertion failure: hasInitialEnvironment(), at js/src/jit/BaselineFrame-inl.h:90

Status: RESOLVED DUPLICATE of bug 1501722

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision c29f681979ee (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

// jsfunfuzz-generated
Function(`
    // Adapted from randomly chosen test: js/src/jit-test/tests/wasm/regress/debug-clone-segment.js
    g = newGlobal();
    g.parent = this;
    g.eval("(" + function() {
        var dbg = Debugger(parent);
        dbg.onEnterFrame = function() {}
    } + ")")
    \`\`;
    // jsfunfuzz-generated
    oomTest(async function() {});
`)();

Backtrace:

#0  0x000056534753a01f in js::jit::BaselineFrame::callObj (this=0x7ffff3077378) at js/src/jit/BaselineFrame-inl.h:90
#1  0x0000565347621604 in js::GetGeneratorObjectForFrame (cx=0x7fbd95118000, frame=...) at js/src/vm/GeneratorObject.cpp:121
#2  0x000056534756e565 in js::Debugger::slowPathOnLeaveFrame (cx=0x7fbd9623f680 <_IO_2_1_stderr_>, frame=..., pc=0x7fbd95197b60 "ԉ", frameOk=false) at js/src/vm/Debugger.cpp:1109
#3  0x0000565346ec48a4 in js::Debugger::onLeaveFrame (cx=0x7fbd95118000, frame=..., pc=0x7fbd95197b60 "ԉ", ok=false) at js/src/vm/Debugger-inl.h:25
#4  0x0000565347256b34 in js::jit::HandleExceptionBaseline (cx=<optimized out>, frame=..., pc=0x0, rfe=<optimized out>) at js/src/jit/JitFrames.cpp:585
/snip

For detailed crash information, see attachment.

Comment 2

[Liz Henry (:lizzard) (relman/hg->git project)]

Marking fix-optional to remove this issue from triage, because we are tracking it in bug 1501722.