876654 - [jsdbg2] Assertion failure: kind == CrossCompartmentKey::DebuggerScript || kind == CrossCompartmentKey::DebuggerObject || kind == CrossCompartmentKey::DebuggerEnvironment, at jsgc.cpp:3241

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c190422547ed (run with --ion-eager):


gczeal(9, 2)
let g = newGlobal('new-compartment');
let dbg = new Debugger(g);
dbg.onNewScript = function (script) {
  var text = script.source.text;
}
g.eval("function f() { function g() {} }");
assertEq(count, 6);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Jon Coppeard (:jonco)]

The GC needs updating in light of the new DebuggerSource object introduced by bug 637572.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: Proposed fix

The assertion in JSCompartment::findOutgoingEdges() needs to be updated now DebuggerSource objects have been added.

Debugger::findCompartmentEdges() was already updated to add edges for these CCWs in one direction.  With the assertion updated JSCompartment::findOutgoingEdges() will add them in the other direction and everything will be fine.

Comment 4

[Terrence Cole [:terrence]]

Comment on attachment 758486 [details] [diff] [review]
Proposed fix

Review of attachment 758486 [details] [diff] [review]:
-----------------------------------------------------------------

r=me

Comment 5

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ccf704fa6fdd

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ccf704fa6fdd