Last Comment Bug 677367 - [jsdbg2] Assertion failure: !fp->isEvalFrame(), at jsinterpinlines.h:276
: [jsdbg2] Assertion failure: !fp->isEvalFrame(), at jsinterpinlines.h:276
Status: RESOLVED FIXED
[inbound]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- critical (vote)
: mozilla9
Assigned To: Luke Wagner [:luke]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-08-08 14:34 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 08:40 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix for m-i (2.33 KB, patch)
2011-08-10 16:26 PDT, Luke Wagner [:luke]
jorendorff: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2011-08-08 14:34:02 PDT
The following code asserts on jsdbg2 branch (revision 82545b1e4129, options -j -m -d):


var g = newGlobal('new-compartment');
var dbg = new Debugger(g);
dbg.onDebuggerStatement = function (frame) {
    var code = "assertEq(c, 'ok');\n";
    assertEq(frame.evalWithBindings("eval(s)", {s: code, a: 1234}).return, undefined);
};
g.eval("function first() { return second(); }");
g.eval("function second() { return eval('third()'); }");
g.eval("function third() { debugger; }");
g.evaluate("first();");
Comment 1 Jason Orendorff [:jorendorff] 2011-08-09 05:29:25 PDT
Reduced a bit:

var g = newGlobal('new-compartment');
var dbg = new Debugger(g);
dbg.onDebuggerStatement = function (frame) {
    frame.eval("eval('0')");
};
g.eval("(function () { debugger; })();");
Comment 2 Jason Orendorff [:jorendorff] 2011-08-09 05:29:38 PDT
This happens in m-i too, with -d:

function f() {}
trap(f, 0, 'eval("2+2")');
f();
Comment 3 Luke Wagner [:luke] 2011-08-10 16:26:59 PDT
Created attachment 552259 [details] [diff] [review]
fix for m-i

Sorry about ignoring your vote; I already had the patch :)

The heavyweight assert was removed since evalInFrame let's you put an eval frame inside a non-heavyweight function.
Comment 4 Jason Orendorff [:jorendorff] 2011-08-10 21:41:46 PDT
Comment on attachment 552259 [details] [diff] [review]
fix for m-i

Great!
Comment 6 Marco Bonardo [::mak] 2011-08-19 03:19:20 PDT
http://hg.mozilla.org/mozilla-central/rev/2e2e0dc4654c
Comment 7 Christian Holler (:decoder) 2013-01-14 08:40:04 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug677367.js.

Note You need to log in before you can comment on or make changes to this bug.