Bug 22734 - Debugger crashes when stepping into a function call in a return statement
Summary: Debugger crashes when stepping into a function call in a return statement
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P1 Normal
Assignee: Cameron Zwarich (cpst)
URL: http://nerget.com/working/crash.html
Depends on:
Reported: 2008-12-08 05:29 PST by Oliver Hunt
Modified: 2008-12-10 22:27 PST (History)
4 users (show)

See Also:

Proposed patch (2.02 KB, patch)
2008-12-10 22:21 PST, Cameron Zwarich (cpst)
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2008-12-08 05:29:06 PST
There's a reproducible crash (assertion failure on debug is attempt to cast an immediate to a cell) when trying to step into a function call in a return statement.

Steps to reproduce:
1. goto http://nerget.com/working/crash.html
2. Enable debugging
3. Set a breakpoint at the return statement in the code
function x(y){}
window.onload = function () {
    return x(12); // <-- set break point here
4. Reload the page
5. When you reach the break point, step into the call
6. Crash :-(
Comment 1 Cameron Zwarich (cpst) 2008-12-08 13:19:28 PST
I'll take a look at this.
Comment 2 Cameron Zwarich (cpst) 2008-12-10 15:07:46 PST
This happens with the bytecode interpreter as well as the JIT, which should make it easier to debug.
Comment 3 Cameron Zwarich (cpst) 2008-12-10 22:21:11 PST
Created attachment 25940 [details]
Proposed patch
Comment 4 Oliver Hunt 2008-12-10 22:23:34 PST
Comment on attachment 25940 [details]
Proposed patch

Comment 5 Cameron Zwarich (cpst) 2008-12-10 22:27:59 PST
Landed in r39198.