Last Comment Bug 678211 - Assertion failure: isScriptFrame(), at ../vm/Stack.h:538 with dummy frame
: Assertion failure: isScriptFrame(), at ../vm/Stack.h:538 with dummy frame
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- critical (vote)
: mozilla8
Assigned To: Jason Orendorff [:jorendorff]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-08-11 09:08 PDT by Christian Holler (:decoder)
Modified: 2011-08-14 04:48 PDT (History)
6 users (show)
khuey: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
v1 (1.14 KB, patch)
2011-08-11 16:01 PDT, Jason Orendorff [:jorendorff]
dvander: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2011-08-11 09:08:16 PDT
The following code crashes on jsdbg2 branch (revision 48e43edc8834, options -j -m -a):


var g = newGlobal('new-compartment');
var N = g.N = 9;
g.eval("function f(i) { if (i < N) f(i + 1); }");
var dbg = Debugger(g);
var arr = [];
dbg.onEnterFrame = function (frame) {
    var i;
    var j = i;
    for (; frame; frame = frame.older)
        this . onEnterFrame(arr[j--], frame);
};
g.f(0);


Not sure if this might be related to bug 678086, the assert is similar but not the same.
Comment 1 Jason Orendorff [:jorendorff] 2011-08-11 15:55:25 PDT
This also exists in mozilla-central (that is, even without jsdbg2). With -j, this asserts the same way:

var g = newGlobal('new-compartment');
g.eval("function f(n) { for (var i = 0; i < n; i++) f(0); }");
g.f(10);

I think this will be pretty easy to patch. Trying it now.
Comment 2 Jason Orendorff [:jorendorff] 2011-08-11 16:01:40 PDT
Created attachment 552535 [details] [diff] [review]
v1
Comment 3 Kyle Huey [:khuey] (Exited; not receiving bugmail, email if necessary) 2011-08-14 04:48:13 PDT
http://hg.mozilla.org/mozilla-central/rev/d71ffe484d24

Note You need to log in before you can comment on or make changes to this bug.