677367 - [jsdbg2] Assertion failure: !fp->isEvalFrame(), at jsinterpinlines.h:276

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following code asserts on jsdbg2 branch (revision 82545b1e4129, options -j -m -d):


var g = newGlobal('new-compartment');
var dbg = new Debugger(g);
dbg.onDebuggerStatement = function (frame) {
    var code = "assertEq(c, 'ok');\n";
    assertEq(frame.evalWithBindings("eval(s)", {s: code, a: 1234}).return, undefined);
};
g.eval("function first() { return second(); }");
g.eval("function second() { return eval('third()'); }");
g.eval("function third() { debugger; }");
g.evaluate("first();");

Comment 1

[Jason Orendorff [:jorendorff]]

Reduced a bit:

var g = newGlobal('new-compartment');
var dbg = new Debugger(g);
dbg.onDebuggerStatement = function (frame) {
    frame.eval("eval('0')");
};
g.eval("(function () { debugger; })();");

Comment 2

[Jason Orendorff [:jorendorff]]

This happens in m-i too, with -d:

function f() {}
trap(f, 0, 'eval("2+2")');
f();

Comment 3

[Luke Wagner [:luke]]

Attachment: fix for m-i

Sorry about ignoring your vote; I already had the patch :)

The heavyweight assert was removed since evalInFrame let's you put an eval frame inside a non-heavyweight function.

Comment 4

[Jason Orendorff [:jorendorff]]

Comment on attachment 552259 [details] [diff] [review]
fix for m-i

Great!

Comment 5

[Luke Wagner [:luke]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/2e2e0dc4654c

Comment 6

[Marco Bonardo [:mak]]

http://hg.mozilla.org/mozilla-central/rev/2e2e0dc4654c

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug677367.js.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/releases/mozilla-release/rev/5bbc3615e387
Update pc in mjit throw-handling to match interp (r=dvander)