677977 - [jsdbg2] Assertion failure: script->ownerObject == owner, at jsscript.cpp:325

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following code asserts on jsdbg2 branch (revision 48e43edc8834, options -j -m):


var g = newGlobal('new-compartment');
var dbg = Debugger(g);
dbg.onDebuggerStatement = function (frame) {
    var s = frame.eval("f").return.script;
};
function test(s) {
    g.eval("line0 = Error().lineNumber;\n" +
           "debugger;\n" +          // line0 + 1
           "function f(i) {\n" +    // line0 + 2
           "}\n");
}
test("i = 128;\n" +  "}\n");
var hits = 0;
dbg.onNewScript = function (s) {
    hits++;
};
assertEq(g.eval("eval('2 + 3')"), 5);
this.gczeal(hits, 2);
var fn = g.Function("a", "return 5 + a;");
var g2 = newGlobal('new-compartment');
dbg.addDebuggee(g2, dbg);
g2.clone(fn);

Comment 1

[Jim Blandy :jimb]

I'm not able to reproduce this crash, even under valgrind. I'm using the given revision and options.

Comment 2

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397