744731 - [jsdbg2] Assertion failure: !script->getGlobalObjectOrNull(), at js/src/vm/Debugger.cpp:2121

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following code asserts on mozilla-central revision 3fa30b0edd15 (options -n -m -a):


var g = newGlobal('new-compartment');
var dbg = Debugger(g);
dbg.onDebuggerStatement = function (frame) {
    for (var f = frame; f; f = f.older) {
        if (f.type === "call" && f.script !== null)
            (assertEq(dbg.findScripts().length, 0));
        assertEq(frame.eval("x();"), null);
}     
};
g.eval("function z() { debugger; }");
g.eval("function y() { z(); }");
g.eval("function x() { y(); }");
assertEq(g.eval("debugger; 'ok';"), "ok");

Comment 1

[Jason Orendorff [:jorendorff]]

Doesn't reproduce. Maybe fixed? Bisecting.

Comment 2

[Jason Orendorff [:jorendorff]]

Unless it's just sporadic, we have:

The first good revision is:
changeset:   95772:b863ef9946b8
user:        Luke Wagner <[e-mail]>
date:        Thu Feb 23 13:59:10 2012 -0800
summary:     Bug 659577 - Don't alias stack variables (r=bhackett)

The relevant change was in Debugger.cpp:

>@@ -3370,6 +3376,7 @@ js::EvaluateInEnv
>     if (!script)
>         return false;
> 
>+    script->isActiveEval = true;
>     return ExecuteKernel(cx, script, *env, fp->thisValue(), EXECUTE_DEBUG, fp, rval);
> }

In other words, Debugger.Frame.eval() and Debugger.Object.evalInGlobal() scripts are now marked as eval scripts.

I'm not sure why luke changed this, but it definitely fixed this specific bug.

Minimized test case:
var g = newGlobal('new-compartment');
var dbg = Debugger(g);
dbg.onDebuggerStatement = function (frame) {
    dbg.onDebuggerStatement = function (frame) {
        dbg.findScripts();
    };
    frame.eval("debugger;");
};
g.eval("debugger;");

I'll check in the passing test and close the bug.

Comment 3

[Jason Orendorff [:jorendorff]]

(In reply to Jason Orendorff [:jorendorff] from comment #2)
> Unless it's just sporadic, we have:

Oops stray line; I should've revised it out when I realized the bug isn't sporadic and everything totally makes sense.

Comment 4

[Jason Orendorff [:jorendorff]]

Pushed tests.

http://hg.mozilla.org/integration/mozilla-inbound/rev/2cf3cca4171e

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Fix is known, updating JSBugMon, in lieu of tests landing, marking in-testsuite+ and VERIFIED.

Comment 6

[Jason Orendorff [:jorendorff]]

"in lieu of" means "instead of".

"in light of" something means taking it into consideration.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Jason Orendorff [:jorendorff] from comment #6)
> "in lieu of" means "instead of".
> 
> "in light of" something means taking it into consideration.

Oops, I definitely meant the latter, I guess.

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/2cf3cca4171e