678211 - Assertion failure: isScriptFrame(), at ../vm/Stack.h:538 with dummy frame

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following code crashes on jsdbg2 branch (revision 48e43edc8834, options -j -m -a):


var g = newGlobal('new-compartment');
var N = g.N = 9;
g.eval("function f(i) { if (i < N) f(i + 1); }");
var dbg = Debugger(g);
var arr = [];
dbg.onEnterFrame = function (frame) {
    var i;
    var j = i;
    for (; frame; frame = frame.older)
        this . onEnterFrame(arr[j--], frame);
};
g.f(0);


Not sure if this might be related to bug 678086, the assert is similar but not the same.

Comment 1

[Jason Orendorff [:jorendorff]]

This also exists in mozilla-central (that is, even without jsdbg2). With -j, this asserts the same way:

var g = newGlobal('new-compartment');
g.eval("function f(n) { for (var i = 0; i < n; i++) f(0); }");
g.f(10);

I think this will be pretty easy to patch. Trying it now.

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

http://hg.mozilla.org/mozilla-central/rev/d71ffe484d24