New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 621361 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug

Blocking:
issue v8:6430



Sign in to add a comment

"Aw, Snap!" when debugging function containing arrow function (not when not debugging)

Reported by t...@crowdersoftware.com, Jun 19 2016

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36

Steps to reproduce the problem:
1. Use the HTML and JavaScript attached and run with dev tools open
2. When hitting the breakpoint, press the Step Over button

What is the expected behavior?
Step to next line in the source

What went wrong?
"Aw, Snap!" and devtools says it gets disconnected (presumably because of the Aw, Snap!). See comments in the JavaScript, it's very specific to an arrow function definition that calls a function defined in a containing scope.

Did this work before? N/A 

Chrome version: 51.0.2704.103  Channel: stable
OS Version: Linux Mint 17.3
Flash Version: Shockwave Flash 22.0 r0

* Only happens when debugging (whether with the debugger statement or a breakpoint)

* Does not happen on Chromium 50.0.2661.102; does happen on Chrome 51.0.2704.103 (both the latest in my stable channel for Linux Mint 17.3)

* Entirely repeatable

* Had several of these the last 3-4 days, virtually none before; updated a few days ago (and again just now), so suspect a recent regression
 
issue.html
138 bytes View Download
issue.js
1.2 KB View Download
"Did this work before? N/A" Apologies, I missed out filling that in. See my final bullet point: Fairly certain this is a recent regression.
Definitely scope chain stuff (a comment I made in the issue.js source), because if I add this inside the scoping function:

function bar() {
    return foo.apply(this, arguments);
}

...and then use `bar` instead of `foo`, the problem goes away. Attached.
issue2.js
1.4 KB View Download
Owner: kozyatinskiy@chromium.org
Status: Assigned (was: Unconfirmed)
Cc: kozyatinskiy@chromium.org
Owner: yangguo@chromium.org
It looks like V8 issue. I attached regression test for V8.
Yang, could you take a look?
regress-621361.js
1.1 KB View Download
Components: Blink>JavaScript
Reduced repro:

var Debug = debug.Debug;

function listener(event, execState, eventData, data) {
  if (event != Debug.DebugEvent.Break) return;
  try {
    print(execState.frame().evaluate("x").value());
    print(execState.frame().sourceLineText());
    execState.prepareStep(Debug.StepAction.StepIn);
  } catch (e) {
    print(e, e.stack);
  }
}

Debug.setListener(listener);

(function() {
  debugger;
  var x = l => l;
})();
The bug is in the scope iterator. The break location in the assignment is at the start of the arrow function

var x = l => l;
        ^___ break

We parse and find nested scopes based on break location, and wrongly assume that we are inside the arrow function.

I have a fix coming up.
Project Member

Comment 8 by bugdroid1@chromium.org, Jul 27 2016

Labels: Merge-Request-52 Merge-Request-53
The fix is fairly simple. I'd like to merge it.
M52 is already in Stable for Desktop and bar is VERY high. We're going to have M52 refresh Stable release next week and we can take this change in ONLY if it is critical, baked/verified in Canary and safe to merge. Please confirm this. Thank you. 
(Seems like this issue is specific to Linux and already exists on M51, so I'm leaning towards NOT to take it for M52 unless it is absolutely critical).
Labels: -OS-Linux
This is not limited to Linux. The bug probably existed a lot longer, and only occurs with DevTools open. So I guess we can also wait, and only merge to M53.
Please remove "Merge-Request-52" label if  M52 merge is not needed per comment #11. Thank you.

Comment 13 by dimu@chromium.org, Jul 28 2016

Labels: -Merge-Request-52 Merge-Review-52 Hotlist-Merge-Review
[Automated comment] Request affecting a post-stable build (M52), manual review required.

Comment 14 by dimu@chromium.org, Jul 28 2016

Labels: -Merge-Request-53 Merge-Approved-53 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M53 (branch: 2785)
Labels: -Merge-Review-52
Project Member

Comment 16 by bugdroid1@chromium.org, Jul 28 2016

Labels: merge-merged-5.3
The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/bd1d4bb4d3e850a63e731de3a984802fa3dd1a6a

commit bd1d4bb4d3e850a63e731de3a984802fa3dd1a6a
Author: Yang Guo <yangguo@chromium.org>
Date: Thu Jul 28 11:03:16 2016

Merged: [debugger] Scope iterator should not visit inner function literals.

Revision: 071b655fa90a3db1f41717f28cb50fe9f2c6db2c

BUG= chromium:621361 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=hablich@chromium.org

Review URL: https://codereview.chromium.org/2187273002 .

Cr-Commit-Position: refs/branch-heads/5.3@{#29}
Cr-Branched-From: 820a23aade5e74a92d794e05a0c2b3597f0da4b5-refs/heads/5.3.332@{#2}
Cr-Branched-From: 37538cb2c1b4d75c41af386cb4fedbe5566f5608-refs/heads/master@{#37308}

[modify] https://crrev.com/bd1d4bb4d3e850a63e731de3a984802fa3dd1a6a/src/debug/debug-scopes.cc
[add] https://crrev.com/bd1d4bb4d3e850a63e731de3a984802fa3dd1a6a/test/mjsunit/regress/regress-crbug-621361.js

Labels: -Merge-Approved-53
Blocking: v8:6430
Status: Fixed (was: Assigned)

Sign in to add a comment