1640034 - Capturing a SavedFrame stack from inside a Debugger eval can cause assertion failures

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Logan Smyth [:loganfsmyth]]

The following snippet reproduces:

const global = newGlobal({ newCompartment: true });
const dbg = new Debugger(global);
dbg.onDebuggerStatement = function() {
  const frame = dbg.getNewestFrame();

  bindToAsyncStack(function() {
    frame.eval(`saveStack()`);
  }, {
    stack: saveStack(),
  })();
};
global.eval(`debugger;`);

Comment 1

[Logan Smyth [:loganfsmyth]]

Attachment: Bug 1640034 - Ensure that we don't bail when we need the parent frame created. r=jorendorff!

The inline comment explains most of this, but essentially because we bail out
of the FrameIter loop early when we find an asyncStack, we can end up with
cases where the a Debugger eval's parent frame either hasn't been populated in
the LiveSavedFrameCache at all, or else has been, but is not instantiated
in the correct realm.

This patch avoids that by no longer bailing when asyncStacks are found, and
instead traversing the whole stack still to make sure that the invariants
for the LiveSavedFrameCache are preserved properly.

Depends on D76425

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/eb657b731e1a
Ensure that we don't bail when we need the parent frame created. r=jorendorff

Comment 3

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/eb657b731e1a