[Webkit-unassigned] [Bug 141396] Web Inspector: CRASH when debugger pauses inside a Promise handler

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=141396

Mark Lam <mark.lam at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |msaboff at apple.com

--- Comment #3 from Mark Lam <mark.lam at apple.com> ---
The JS call stack at the time the debugger breaks:
      frame 0x7fff5af1aca0 {
         name ''
         sourceURL 'file:///Volumes/Data/ws1/OpenSource/brrian-test.js'
         isInlinedFrame 0
         callee 0x11cbd8930
         returnPC 0x10f466e29
         callerFrame 0x7fff5af1b560
         rawLocationBits 25 0x19
         codeBlock 0x11b772960
            bytecodeOffset 25 0x19 / 32
            line 2
            column 5
            jitType 2 <InterpreterThunk> isOptimizingJIT 0
            hasCodeOrigins 0
      }
      frame 0x7fff5af1b560 {
         name 'Promise'
         sourceURL '[native code]'
         isInlinedFrame 0
         callee 0x11cbaf790
         returnPC 0x0
         callerFrame 0x7fff5af1b5d0
         rawLocationBits 32767 0x7fff
         codeBlock 0x0
      }
      frame 0x7fff5af1b5d0 {
         name 'global code'
         sourceURL 'file:///Volumes/Data/ws1/OpenSource/brrian-test.js'
         isInlinedFrame 0
         callee 0x11cbaf5f0
         returnPC 0x10f466e29
         callerFrame 0x0
         rawLocationBits 43 0x2b
         codeBlock 0x11b772708
            bytecodeOffset 43 0x2b / 66
            line 1
            column 20
            jitType 2 <InterpreterThunk> isOptimizingJIT 0
            hasCodeOrigins 0
      }

The crash is due to an assertion when the DebuggerCallFrame tries to get the callee scope of the 2nd frame (“Promise” constructor).  The DebuggerCallFrame does so by jsCast’ing the callee to a JSCallee and invoking its scope() method.  However, the Promise constructor is an InternalFunction which does not inherit from JSCallee.  Hence, the assertion failure.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150210/8e424383/attachment-0002.html>