BaselineCompiler: [jsdbg2] Assertion failure: it.isBaselineJS(), at ion/IonFrames.cpp:895

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on baseline compiler branch revision 1c8552cc6ec4 (run with ):


var g = newGlobal('new-compartment');
var dbg = new Debugger(g);
g.eval('function f(n) { if (n > 0) f(n-1); else debugger; }');
dbg.onEnterFrame = function handleEnter(frame) {
    frame.onPop = function handlePop(c) {
        assertEq(typeof c == "object" && actual.getOwnPropertyNames, true);
    };
};
g.f(10);
(Assignee)

Comment 1

5 years ago
Created attachment 716452 [details] [diff] [review]
Patch

In some corner cases, the debugger can call GetPcScript with an Unwound_BaselineStub instead of BaselineStub frame on the stack. This patch fixes GetPcScript to handle the former too.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #716452 - Flags: review?(kvijayan)

Updated

5 years ago
Attachment #716452 - Flags: review?(kvijayan) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/1bd4ca81f158
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.