864580 - [jsdbg2] Assertion failure: site->firstBreakpoint() == __null, at jsscript.cpp:2472

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 4f364593f8bf (run with --ion-eager):


eval("(function() { " + "\
var g = newGlobal('new-compartment');\
var dbg = new Debugger();\
var gw = dbg.addDebuggee(g);\
g.eval('' +\ function fib(n) {});\
gw.makeDebuggeeValue(g.fib).script.setBreakpoint(0, { $ : function (f) { } });\
  dbg.removeDebuggee(g);\
" + " })();");
eval("(function() { " + "\
schedulegc(this);\
gc('compartment');\
" + " })();");

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   91130:15a23c3923ff
user:        Bill McCloskey
date:        Tue Apr 03 14:07:38 2012 -0700
summary:     Bug 742570 - Improve GC testing functions (r=igor)

This iteration took 77.050 seconds to run.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 73eefb421e2a).

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/b8a6bf4b4fa3
user:        Jon Coppeard
date:        Sat Jan 11 13:52:35 2014 +0000
summary:     Bug 956324 - Remove all breakpoints from a debugger when the last debuggee is removed r=billm

Jon, is bug 956324 a likely fix?

Comment 4

[Jon Coppeard (:jonco)]

Yes, definitely.

Can you check in the testcase as a test though?  I think Jim said we don't exercise removing debuggees in the browser (and obviously the jittests didn't cant this before) so this would be good to have.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Marking FIXED by bug 956324, and setting in-testsuite? flag.

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.