Ensure crash 2

Create a method like this:

Object>>#test
 
   [1/>self halt] ensure:[].

When you hit the halt, edit the method in the browser, and save it. You will get a VM crash.

Explanation: This crash is within Debugger>>convert:to:offset:. The primitive behind this method does not make any checks of the arguments, so when it is invoked with a wrong offset, it simply searches forever through memory until it fails when it encounters an uncommitted page. So we have to locate why it is invoked with wrong arguments. In this case it is called by

Debugger expandFrame: 0,

which is called from

 

Process>>dropFrames:

when handling protectionBlocks.

Fix: Debugger fixes for protected blocks