Last Comment Bug 678529 - [jsdbg2] Assertion failure: !args.rval().isPrimitive(), at jsinterp.cpp:679
: [jsdbg2] Assertion failure: !args.rval().isPrimitive(), at jsinterp.cpp:679
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86 Linux
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-08-12 09:37 PDT by Christian Holler (:decoder)
Modified: 2013-02-07 05:18 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Christian Holler (:decoder) 2011-08-12 09:37:25 PDT
The following code crashes on jsdbg2 branch (revision 48e43edc8834, options -j -m -a -d):


var g = newGlobal('new-compartment');
var dbg = Debugger(g);
dbg.onDebuggerStatement = function (stack) { return {return: 1234}; };
g.eval("function f() { debugger; return 'bad'; }");
assertEq(new g.f(), 1234);
Comment 1 Jim Blandy :jimb 2012-01-11 12:15:14 PST
This seems to have been fixed by this changeset:

changeset:   81371:4ecf595875a5
user:        Jim Blandy <jimb@mozilla.com>
date:        Sat Dec 03 18:51:30 2011 -0800
summary:     Bug 700070: Have stubs::AnyFrameEpilogue call the full ScriptEpilogue before StackFrame::functionEpilogue, not just ScriptDebugEpilogue after functionEpilogue. r=jorendorff
Comment 2 Christian Holler (:decoder) 2013-02-07 05:18:26 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397

Note You need to log in before you can comment on or make changes to this bug.