1613351 - Assertion failure: !mEntered, at dist/include/mozilla/Vector.h:465 with Debugger

Status: RESOLVED DUPLICATE of bug 1608891

(Core :: JavaScript Engine, defect, P2)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20200204-a117660624ec (build with --enable-debug), run with --fuzzing-safe --no-threads --ion-warmup-threshold=1 --baseline-warmup-threshold=0 --disable-oom-functions):

gczeal(14,10);
function checkGetOffsetsCoverage(fun) {
  var source = fun.toString();
  source = source.slice(source.indexOf('{') + 1, source.lastIndexOf('}'));
  var g64 = newGlobal({newCompartment: true});
  var dbg = Debugger(g64);
  dbg.onNewScript = function (s60) {
    topLevel = s60;
  };
  g64.eval(source);
  function collectCoverage(s60) {
    s60.getOffsetsCoverage();
  };
  collectCoverage(topLevel);
}
checkGetOffsetsCoverage(function () {
  try {} catch (x78) {}
});

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x0000555555c6e580 in js::ScriptCounts::maybeGetThrowCounts(unsigned long) const ()
#1  0x000055555606e10a in js::DebuggerScript::CallData::getOffsetsCoverage() ()
#2  0x0000555556073d88 in bool js::DebuggerScript::CallData::ToNative<&js::DebuggerScript::CallData::getOffsetsCoverage>(JSContext*, unsigned int, JS::Value*) ()
#3  0x00005555558f3f32 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) ()
#4  0x00005555558f384f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) ()
#5  0x00005555563bef29 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) ()
[...]
#9  0x0000000000000000 in ?? ()
rax	0x555556e5b448	93825018475592
rbx	0x7ffff5c52e80	140737316728448
rcx	0x555557f3d840	93825036179520
rdx	0x0	0
rsi	0x7ffff6efd770	140737336301424
rdi	0x7ffff6efc540	140737336296768
rbp	0x7fffffff9bd0	140737488329680
rsp	0x7fffffff9bd0	140737488329680
r8	0x7ffff6efd770	140737336301424
r9	0x7ffff7f9cd00	140737353731328
r10	0x58	88
r11	0x7ffff6ba47a0	140737332791200
r12	0x7fffffff9c88	140737488329864
r13	0x1	1
r14	0x7fffffff9df8	140737488330232
r15	0x0	0
rip	0x555555c6e580 <js::ScriptCounts::maybeGetThrowCounts(unsigned long) const+144>
=> 0x555555c6e580 <_ZNK2js12ScriptCounts19maybeGetThrowCountsEm+144>:	movl   $0x1d1,0x0
   0x555555c6e58b <_ZNK2js12ScriptCounts19maybeGetThrowCountsEm+155>:	callq  0x5555557fb7a6 <abort>

Comment 1

[Ted Campbell [:tcampbell]]

PRobably a dupe of Bug 1608891

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: testcase.js

Comment 3

[Jason Kratzer [:jkratzer]]

JSBugmon: Reduced build range to...
> Start: e966603209bba385cac292c937cd74d9426a3412 (20191004211026)
> End: 74c62117e3e5215f69a07e5ba0adddae33773060 (20191004213811)
> Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e966603209bba385cac292c937cd74d9426a3412&tochange=74c62117e3e5215f69a07e5ba0adddae33773060

Comment 4

[BugBot [:suhaib / :marco]]

In the process of migrating remaining bugs to the new severity system, the severity for this bug cannot be automatically determined. Please retriage this bug using the new severity system.