The default bug view has changed. See this FAQ.

Assertion failure: isScriptFrame(), at ../vm/Stack.h:538 with dummy frame

RESOLVED FIXED in mozilla8

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: decoder, Assigned: jorendorff)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Other Branch
mozilla8
x86_64
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following code crashes on jsdbg2 branch (revision 48e43edc8834, options -j -m -a):


var g = newGlobal('new-compartment');
var N = g.N = 9;
g.eval("function f(i) { if (i < N) f(i + 1); }");
var dbg = Debugger(g);
var arr = [];
dbg.onEnterFrame = function (frame) {
    var i;
    var j = i;
    for (; frame; frame = frame.older)
        this . onEnterFrame(arr[j--], frame);
};
g.f(0);


Not sure if this might be related to bug 678086, the assert is similar but not the same.
(Assignee)

Comment 1

6 years ago
This also exists in mozilla-central (that is, even without jsdbg2). With -j, this asserts the same way:

var g = newGlobal('new-compartment');
g.eval("function f(n) { for (var i = 0; i < n; i++) f(0); }");
g.f(10);

I think this will be pretty easy to patch. Trying it now.
Summary: [jsdbg2] Assertion failure: isScriptFrame(), at ../vm/Stack.h:538 → Assertion failure: isScriptFrame(), at ../vm/Stack.h:538 with dummy frame
(Assignee)

Comment 2

6 years ago
Created attachment 552535 [details] [diff] [review]
v1
Assignee: general → jorendorff
Attachment #552535 - Flags: review?(dvander)
Attachment #552535 - Flags: review?(dvander) → review+
http://hg.mozilla.org/mozilla-central/rev/d71ffe484d24
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla8
You need to log in before you can comment on or make changes to this bug.