Last Comment Bug 700070 - Debugger: onExceptionUnwind resumption values can cause assertions
: Debugger: onExceptionUnwind resumption values can cause assertions
Status: RESOLVED FIXED
[inbound]
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
: -- normal (vote)
: mozilla11
Assigned To: Jim Blandy :jimb
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: 687683
  Show dependency treegraph
 
Reported: 2011-11-05 17:15 PDT by Jim Blandy :jimb
Modified: 2012-02-01 13:57 PST (History)
0 users
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Have stubs::AnyFrameEpilogue call the full ScriptEpilogue before StackFrame::functionEpilogue, not just ScriptDebugEpilogue after functionEpilogue. (3.72 KB, patch)
2011-11-05 17:15 PDT, Jim Blandy :jimb
jorendorff: review+
Details | Diff | Splinter Review

Description Jim Blandy :jimb 2011-11-05 17:15:37 PDT
Created attachment 572241 [details] [diff] [review]
Have stubs::AnyFrameEpilogue call the full ScriptEpilogue before StackFrame::functionEpilogue, not just ScriptDebugEpilogue after functionEpilogue.

The debugger tests don't try returning all four kinds of resumption values
from an onExceptionUnwind handler, and under JaegerMonkey, forcing a
constructor to return a primitive can cause an assertion:

Assertion failure: !args.rval().isPrimitive(), at /home/jimb/moz/dbg/js/src/jsinterp.cpp:651

This patch changes AnyFrameEpilogue to match what the interpreter and
mjit::Compiler::emitReturn does, and adds test cases for all the resumption
values.
Comment 1 Jason Orendorff [:jorendorff] 2011-11-22 15:15:07 PST
Comment on attachment 572241 [details] [diff] [review]
Have stubs::AnyFrameEpilogue call the full ScriptEpilogue before StackFrame::functionEpilogue, not just ScriptDebugEpilogue after functionEpilogue.

Does rearranging the order of ScriptEpilogue and functionEpilogue matter? It could if there's a JSD1 debugging hook that gets called from ScriptEpilogue, but I don't think it really matters. Either order is fine.

r=me.
Comment 2 Jim Blandy :jimb 2011-12-03 18:13:48 PST
(In reply to Jason Orendorff [:jorendorff] from comment #1)
> Does rearranging the order of ScriptEpilogue and functionEpilogue matter? It
> could if there's a JSD1 debugging hook that gets called from ScriptEpilogue,
> but I don't think it really matters. Either order is fine.

I think it doesn't matter, because all functionEpilogue does is 'put' the call object or arguments object. Those objects have to work properly both before and after that call. If anyone can access the actual stack slots they used to alias, then I guess one could see that they're not aliased any more. But can they?
Comment 4 Ed Morley [:emorley] 2011-12-04 07:19:08 PST
When pushing to inbound, please can you set the assignee & target milestone (https://wiki.mozilla.org/Tree_Rules/Inbound#Please_do_the_following_after_pushing_to_inbound), thanks :-)

https://hg.mozilla.org/mozilla-central/rev/4ecf595875a5
Comment 5 Jim Blandy :jimb 2011-12-06 12:16:13 PST
(In reply to Ed Morley [:edmorley] from comment #4)
> When pushing to inbound, please can you set the assignee & target milestone
> (https://wiki.mozilla.org/Tree_Rules/
> Inbound#Please_do_the_following_after_pushing_to_inbound), thanks :-)
> 
> https://hg.mozilla.org/mozilla-central/rev/4ecf595875a5

Thanks; I'll do this in the future.

Note You need to log in before you can comment on or make changes to this bug.