498232 - Crash in JS_EvaluateUCInStackFrame (jsdbgapi.cpp line 1245)

Status: RESOLVED DUPLICATE of bug 497998

(Core :: JavaScript Engine, defect)

Description

[Karsten Düsterloh]

Attachment: gdb stack

SeaMonkey debug build, i.e. m-c 1.9.1 branch, plus Venkman.
Hitting any breakpoint crashes SM with the attached stack:

#0  0x00007f2d2ccb8095 in raise () from /lib/libc.so.6
#1  0x00007f2d2ccb9af0 in abort () from /lib/libc.so.6
#2  0x00007f2d30aa55ad in JS_Assert (s=0x7f2d30acd1c3 "cx->fp", file=0x7f2d30accf60 "/home/kd/projekte/mozilla/mozilla.org/src/trunk/mozilla/js/src/jsdbgapi.cpp", ln=1245) at /home/kd/projekte/mozilla/mozilla.org/src/trunk/mozilla/js/src/jsutil.cpp:69
#3  0x00007f2d309c4c32 in JS_EvaluateUCInStackFrame (cx=0x7f2d15c27400, fp=0x7fff39140e70, chars=0x7f2d1ec58f80, length=170, filename=0x7f2d15d7bd00 "x-jsd:value-record", lineno=1, rval=0x7fff3913c618) at /home/kd/projekte/mozilla/mozilla.org/src/trunk/mozilla/js/src/jsdbgapi.cpp:1245
...

The crashing assertion was introduced by bug 496824.

Example steps to reproduce:
- start SM debug build with -venkman -browser
- tell Venkman to break in the onunload handler of the browser window
- close the browser window
=> Crash