I'm not able to reproduce that problem with 50.0.2661.75 when evaluating the variable in the temporal dead zone; I get the expected reference error.

Are you able to reproduce if you disable the Angular JS dev tools extension?

Yes. Try evaluating not the variable itself, but its property.
Reproduced with 50.0.2661.75 and 50.0.2661.87 (extensions off).
Also Opera 36.0.2130.65 (clean install).

Deleted: crash_1.png 124 KB

	crash_1.png 124 KB View Download

Deleted: crash_2.png 121 KB

	crash_2.png 121 KB View Download

Deleted: crash_3.png 396 KB

	crash_3.png 396 KB View Download

Issue looks similar to earlier reported crash based on stack trace comparison "523912". Hence merging the issue.

Thank you!

max.korenko, thanks for the report.

I'm able to repro with 50.0.2661.86. Cannot repro with 51.0.2704.22/Beta.

ashejole, please don't dupe reports with repro instructions into tracker bugs that are marked WontFix. Doing so just loses valuable information, because this report is actionable, whereas 523912 is not actionable and hence will not get looked at.

It would be very helpful if someone could bisect this to find out when it got fixed (presumably somewhere between the M50 branch point and the M51 branch point), so we know what we have to backmerge.

@jkummerow: Thanks for the suggestion, I will follow the same while triaging actionable crash issue.


The above issue is reproducible on All-OS (Windows (10 & 7), Mac 10.11.4 & Ubuntu 14.04) with chrome versions : 50.0.2661.87/86(Stable) with the steps provided in original bug. This issue is fixed in 51.0.2704.22(Beta) & 52.0.2717.0(Canary). 


Below is the reverse bisect info
==================
Last known Bad build: 51.0.2695.0
First known Good build: 51.0.2696.0


Narrow bisect
=============
You are probably looking for a change made after 384306 (known bad), but no later than 384321 (first known good).
CHANGELOG URL:
  https://chromium.googlesource.com/chromium/src/+log/4b8cfeaa7bb2abd743076eb419944c845f2b98f5..611d653b4395bc225864e070985f1d442dc347d6


From the narrow bisect, I am suggesting CL from v8: https://chromium.googlesource.com/v8/v8/+/297daf6c37d6e4145e8aaec12ccc9762ac180850, might have fixed the  issue ?

@yangguo: Hey, can you please check the above issue and see if your CL has fixed the above issue in Beta & Dev ?

If so, request you to merge the above issue to M50 if required. Marking the above issue as RB-Stable, feel free to remove if not required.

Feel free to route the above issue to concern dev, if your CL has not fixed the above issue.

I really appreciate your help.

Thank you!

This is indeed very likely to be fixed by https://chromium.googlesource.com/v8/v8/+/297daf6c37d6e4145e8aaec12ccc9762ac180850

This is a major rework of debug-evaluate. I don't think it should be merged back. I realize that this crash could irrate users of Devtools. I probably could write a fix for M50 specifically. However, given that we already have a fix, I'm not sure that's worthwhile.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/215351f8bf4352b98aeb738810468c5665226097

commit 215351f8bf4352b98aeb738810468c5665226097
Author: yangguo <yangguo@chromium.org>
Date: Tue Apr 26 14:04:17 2016

[debugger] fix crash in debug-evaluate when retrieving values in TDZ.

R=jkummerow@chromium.org
BUG= chromium:605581 
LOG=N
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1916413002

Cr-Commit-Position: refs/branch-heads/5.0@{#43}
Cr-Branched-From: ad16e6c2cbd2c6b0f2e8ff944ac245561c682ac2-refs/heads/5.0.71@{#1}
Cr-Branched-From: bd9df50d75125ee2ad37b3d92c8f50f0a8b5f030-refs/heads/master@{#34215}

[modify] https://crrev.com/215351f8bf4352b98aeb738810468c5665226097/include/v8-version.h
[modify] https://crrev.com/215351f8bf4352b98aeb738810468c5665226097/src/debug/debug-evaluate.cc
[add] https://crrev.com/215351f8bf4352b98aeb738810468c5665226097/test/mjsunit/regress/regress-crbug-605581.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/eee6ddb2ac0dab0d3e3ab5d1a9d43709a76f9442

commit eee6ddb2ac0dab0d3e3ab5d1a9d43709a76f9442
Author: yangguo <yangguo@chromium.org>
Date: Tue Apr 26 14:09:00 2016

[debugger] add test case for debug-evaluate for values in TDZ.

R=jkummerow@chromium.org
BUG= chromium:605581 
LOG=N

Review URL: https://codereview.chromium.org/1920953003

Cr-Commit-Position: refs/heads/master@{#35794}

[add] https://crrev.com/eee6ddb2ac0dab0d3e3ab5d1a9d43709a76f9442/test/mjsunit/regress/regress-crbug-605581.js

Fixed on V8's 5.0 branch per #7. The next Chrome M50 refresh should pick up the fix.

Thanks a lot for the quick turn around, much appreciated.