Last Comment Bug 678211 - Assertion failure: isScriptFrame(), at ../vm/Stack.h:538 with dummy frame
: Assertion failure: isScriptFrame(), at ../vm/Stack.h:538 with dummy frame
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
-- critical (vote)
: mozilla8
Assigned To: Jason Orendorff [:jorendorff]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz
  Show dependency treegraph
Reported: 2011-08-11 09:08 PDT by Christian Holler (:decoder)
Modified: 2011-08-14 04:48 PDT (History)
6 users (show)
khuey: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

v1 (1.14 KB, patch)
2011-08-11 16:01 PDT, Jason Orendorff [:jorendorff]
dvander: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2011-08-11 09:08:16 PDT
The following code crashes on jsdbg2 branch (revision 48e43edc8834, options -j -m -a):

var g = newGlobal('new-compartment');
var N = g.N = 9;
g.eval("function f(i) { if (i < N) f(i + 1); }");
var dbg = Debugger(g);
var arr = [];
dbg.onEnterFrame = function (frame) {
    var i;
    var j = i;
    for (; frame; frame = frame.older)
        this . onEnterFrame(arr[j--], frame);

Not sure if this might be related to bug 678086, the assert is similar but not the same.
Comment 1 User image Jason Orendorff [:jorendorff] 2011-08-11 15:55:25 PDT
This also exists in mozilla-central (that is, even without jsdbg2). With -j, this asserts the same way:

var g = newGlobal('new-compartment');
g.eval("function f(n) { for (var i = 0; i < n; i++) f(0); }");

I think this will be pretty easy to patch. Trying it now.
Comment 2 User image Jason Orendorff [:jorendorff] 2011-08-11 16:01:40 PDT
Created attachment 552535 [details] [diff] [review]
Comment 3 User image Kyle Huey [:khuey] (Exited; not receiving bugmail, email if necessary) 2011-08-14 04:48:13 PDT

Note You need to log in before you can comment on or make changes to this bug.