497212 - Firebug: Hitting a breakpoint and single stepping crashes the browser.

Status: VERIFIED DUPLICATE of bug 497119

(Core :: JavaScript Engine, defect)

Description

[Curtis Bartley [:cbartley]]

If you set a breakpoint in Firebug, trigger it, and then single step until full control should return to the browser, Firefox crashes.

Firebug version 1.4a31.
Mozilla-1.9.1: 25920:c1a708160268

Note that this test case will trigger bug #497177 on trunk.  It's possible these two bugs are related -- the test cases are very similar -- but the symptoms are quite different.

Last few lines of console output:
--------------------------------

###!!! ASSERTION: Inner window detected in Equality hook!: 'win->IsOuterWindow()', file /Users/cbartley/dev/mozilla-1.9.1/src/dom/src/base/nsDOMClassInfo.cpp, line 6644
###!!! ASSERTION: Inner window detected in Equality hook!: 'other->IsOuterWindow()', file /Users/cbartley/dev/mozilla-1.9.1/src/dom/src/base/nsDOMClassInfo.cpp, line 6650
JavaScript strict warning: chrome://firebug/content/debugger.js, line 2469: reference to undefined property this.context.debugFrame
JavaScript strict warning: chrome://firebug/content/firebug.js, line 1249: reference to undefined property persistedState.panelState[panel.name]
JavaScript strict warning: chrome://firebug/content/commandLine.js, line 519: reference to undefined property panel.context.commandLineText
JavaScript strict warning: chrome://firebug/content/firebug.js, line 2439: reference to undefined property this.sourceBoxes[url]
JavaScript strict warning: chrome://firebug/content/debugger.js, line 1806: assignment to undeclared variable lineNode
###!!! ASSERTION: Inner window detected in Equality hook!: 'win->IsOuterWindow()', file /Users/cbartley/dev/mozilla-1.9.1/src/dom/src/base/nsDOMClassInfo.cpp, line 6644
###!!! ASSERTION: Inner window detected in Equality hook!: 'other->IsOuterWindow()', file /Users/cbartley/dev/mozilla-1.9.1/src/dom/src/base/nsDOMClassInfo.cpp, line 6650
###!!! ASSERTION: Inner window detected in Equality hook!: 'win->IsOuterWindow()', file /Users/cbartley/dev/mozilla-1.9.1/src/dom/src/base/nsDOMClassInfo.cpp, line 6644
###!!! ASSERTION: Inner window detected in Equality hook!: 'other->IsOuterWindow()', file /Users/cbartley/dev/mozilla-1.9.1/src/dom/src/base/nsDOMClassInfo.cpp, line 6650
WARNING: NS_ENSURE_TRUE(prop_count) failed: file /Users/cbartley/dev/mozilla-1.9.1/src/js/jsd/jsd_xpc.cpp, line 2228
###!!! ASSERTION: Inner window detected in Equality hook!: 'win->IsOuterWindow()', file /Users/cbartley/dev/mozilla-1.9.1/src/dom/src/base/nsDOMClassInfo.cpp, line 6644
###!!! ASSERTION: Inner window detected in Equality hook!: 'other->IsOuterWindow()', file /Users/cbartley/dev/mozilla-1.9.1/src/dom/src/base/nsDOMClassInfo.cpp, line 6650

Comment 1

[Curtis Bartley [:cbartley]]

Attachment: Test case

Repro Steps

   1. Install the latest Firebug 1.4 alpha, for example firebug-1.4.0a31.xpi.
   2. Open the test page in Firefox.
   3. Open Firebug and make sure it's completely enabled for the page.
   4. Tab to the Script panel.
   5. If all the line numbers in the Script panel are greyed out, reload the page.
   6. Set a breakpoint on the call to yada() in OnClick()
   7. Click the button.
   8. After Firefox breaks into the debugger, click the step-over button (middle of the three yellow buttons) once.
   9. Now click anywhere in the Firebug UI a couple of times.

Expected Behavior

    * Firebug should exit debugger mode and Firefox should continue running normally.

Actual Behavior

    * Firefox crashes, the beachball cursor comes up, and a problem report is generated.

Comment 2

[Curtis Bartley [:cbartley]]

Attachment: OSX problem report generated from the crash.

Comment 3

[John J. Barton]

Do you have a crash-stats URL for this one?

Comment 4

[Curtis Bartley [:cbartley]]

(In reply to comment #3)
> Do you have a crash-stats URL for this one?

I don't think so, but I don't know what a "crash-stats URL" is, so I can't say for sure...

Comment 5

[John J. Barton]

After crashreporter comes up, restart FF and "about:crashes" URL will have links to crash-stats site, with stack trace.

Comment 6

[John J. Barton]

Sorry, I looked at commment 2, and this looks like another frame.eval() case.

Comment 7

[Curtis Bartley [:cbartley]]

PASS: r25892 http://hg.mozilla.org/releases/mozilla-1.9.1/rev/f706df925e9f
FAIL: r25893 http://hg.mozilla.org/releases/mozilla-1.9.1/rev/abd967e2173b

This bug is quite likely a dupe of bug 497119, which has a similar stacktrace and a similar regression range.