Node: Use of variables + for loop + switch in a generator function causes inspector to crash

[matthewp]

• Version: 7.6.0
• Platform: Darwin Matthews-MBP-2.lan 16.3.0 Darwin Kernel Version 16.3.0: Thu Nov 17 20:23:58
• Subsystem: Unknown

I was able to reduce it down to this code:

tcase.js

function* serialize() {
  for(let i = 0; i < 10; i++) {
    let value;
    let section = {};

    debugger;

    switch('foo') {
      case 'bar':
        let items = [];
        break;
    }
  }
}

let gen = serialize();
gen.next();

Run with node --debug-brk --inspect tcase.js. Stop on the debugger and then click to step over. It will crash with 1] 50320 illegal hardware instruction node --debug-brk --inspect tcase.js.

I dumped the output into this gist.

[targos]

I can reproduce on master

[targos]

Backtrace with a debug build:

(gdb) bt
#0  v8::base::OS::Abort () at ../deps/v8/src/base/platform/platform-posix.cc:230
#1  0x00000000026fb2b7 in V8_Fatal (file=0x293a348 "../deps/v8/src/debug/debug-scopes.cc", line=257, format=0x293983a "Check failed: %s.") at ../deps/v8/src/base/logging.cc:67
#2  0x0000000001cc562f in v8::internal::ScopeIterator::Type (this=0x7fffffffa4f0) at ../deps/v8/src/debug/debug-scopes.cc:257
#3  0x0000000001cc4d5f in v8::internal::ScopeIterator::MaterializeScopeDetails (this=0x7fffffffa4f0) at ../deps/v8/src/debug/debug-scopes.cc:179
#4  0x000000000210307a in v8::internal::__RT_impl_Runtime_GetAllScopesDetails (args=..., isolate=0x3863600) at ../deps/v8/src/runtime/runtime-debug.cc:886
#5  0x0000000002102ca7 in v8::internal::Runtime_GetAllScopesDetails (args_length=4, args_object=0x7fffffffaa48, isolate=0x3863600) at ../deps/v8/src/runtime/runtime-debug.cc:861
#6  0x0000273d428843a7 in ?? ()
#7  0x0000273d429dfa8e in ?? ()
#8  0x0000273d428842e1 in ?? ()
#9  0x00007fffffffaa00 in ?? ()
#10 0x0000000300000000 in ?? ()
#11 0x00007fffffffaa78 in ?? ()
#12 0x0000273d429df5f5 in ?? ()
#13 0x0000140895d02421 in ?? ()
#14 0x0000000000000000 in ?? ()

[hashseed]

Will take a look.

[hashseed]

I can reproduce this in d8. File V8 bug here: https://bugs.chromium.org/p/v8/issues/detail?id=6085

[hashseed]

Fix upcoming.

[hashseed]

https://chromium.googlesource.com/v8/v8.git/+/09de9969ccb9bc3bbd667788afad665b309d02f5