Bug 25917 – REGRESSION (r43559?): Javascript debugger crashes when pausing page

• Status: RESOLVED
• Resolution: FIXED
• Component: Web Inspector (Deprecated)

[Johan Bergström]

I've been able to reproduce a crash in the js debugger by:
1: Visiting a pastebin such as this http://pastebin.com/f1e0717d9 (will expire june 21st '09)
2: Hit develop -> start debugging javascript
3: Pause and/or reload page

The crash occured instantly the first time, but while trying to reproduce I got mixed results, having to toggle / reload a time or two.

Crash log attached

[Johan Bergström]

Created attachment 30528 [details]
crash log

[Mark Rowe (bdash)]

I can easily reproduce this as well.  We're crashing inside a call to JSValue::isObject due to the JSValue's pointer being 0.

[Mark Rowe (bdash)]

<rdar://problem/6910066>

[Cameron Zwarich (cpst)]

This is almost surely caused by r43559:

<http://trac.webkit.org/changeset/43559>

GDB says that it is getting a property named 'arguments' from a register slot and ending up with a null value, which is very similar to <http://trac.webkit.org/changeset/43603> and <http://trac.webkit.org/changeset/43606>.

[Cameron Zwarich (cpst)]

The problem is in this code in JSActivation::getOwnPropertySlot():

    if (symbolTableGet(propertyName, slot))
        return true;

    if (JSValue* location = getDirectLocation(propertyName)) {
        slot.setValueSlot(location);
        return true;
    }

    // Only return the built-in arguments object if it wasn't overridden above.
    if (propertyName == exec->propertyNames().arguments) {
        slot.setCustom(this, getArgumentsGetter());
        return true;
    }

The first check in the symbol table needs to be modified to account for lazy arguments creation.

[Cameron Zwarich (cpst)]

I am not sure of the right way to fix this. You don't want to call out to Interpreter::retrieveArguments() every time, and you don't even have the function in JSActivation to pass to retrieveArguments().

[Mark Rowe (bdash)]

Fixed in r43976.