1900740 - Assertion failure: state == Type2State<T>::result, at dist/include/mozilla/MaybeOneOf.h:60

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P1)

Description

[Nils Bars]

Attachment: type2state.js

Steps to reproduce:

Checkout commit d9496bfef09039b2642da45585ca821c36917c6d and invoke the js shell as follows:

./js-spidermonkey-shell --fast-warmup --fuzzing-safe frameptr_has_cached_saved_frame.js

Actual results:

Assertion failure: state == Type2State<T>::result, at dist/include/mozilla/MaybeOneOf.h:60

Comment 1

[Jan de Mooij [:jandem]]

Problem with Wasm debugger support.

function c() {
    var dbg = newGlobal({newCompartment: true}).Debugger(this);
    dbg.getNewestFrame().older.offset;
}
function b() {
    var bin = wasmTextToBinary(`(module(import "m" "f" (func $f))(func (export "test")call $f))`);
    var mod = new WebAssembly.Module(bin);
    var inst = new WebAssembly.Instance(mod, {m: {f: c}});
    inst.exports.test()
    inst.exports.test()
}
for (var i = 0; i < 5; i++) {
    b();
}

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Bug 1900740 - Skip non-Wasm frames in FrameIter::wasmUpdateBytecodeOffset. r?yury!

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8669629f6d9e
Skip non-Wasm frames in FrameIter::wasmUpdateBytecodeOffset. r=yury

Comment 4

[Aron Cseh]

https://hg.mozilla.org/mozilla-central/rev/8669629f6d9e