857580 - BaselineCompiler: Assertion failure: ICStub::CanMakeCalls(stub->kind()), at ion/IonFrames.cpp:702 with Debugger

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on baseline compiler branch revision 5fd27c1b3943 (run with --ion-eager):


gczeal(2);
var g = newGlobal('new-compartment');
var dbg = new Debugger(g);
dbg.onNewScript = function(script) {
  fscript = script.getChildScripts()[0];
}
g.eval("function f(x) { arguments[0] = 3; return x }");
fscript.setBreakpoint(0, {hit:function(frame) {
  assertEq(frame.eval('x').return, 1);
  return {return:42};
}});
assertEq(g.f(1), 42);

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Debug-mode only. The breakpoint trampoline reuses the stub frame machinery, but could store a bogus ICStub pointer in the stub frame. The patch just stores a NULL stub pointer. (The trampoline code is stored in IonRuntime so is never GC'ed).

Comment 2

[Christian Holler (:decoder)]

Switching this bug to trunk now :)

Comment 3

[Kannan Vijayan [:djvj]]

Comment on attachment 733245 [details] [diff] [review]
Patch

Review of attachment 733245 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch.

Comment 4

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/97d4b08ee4af

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/97d4b08ee4af