Closed Bug 476214 Opened 15 years ago Closed 15 years ago

TM: "Assertion failure: *(JSObject**)slot == NULL" on http://zaojiao.com/

Categories

(Core :: JavaScript Engine, defect, P2)

1.9.1 Branch
x86
macOS
defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: cbook, Unassigned)

References

()

Details

(Keywords: assertion)

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090130 Firefox/3.2a1pre

Happened during the TopSite Testing on http://zaojiao.com/ - for some reasons i can reproduce this assertion on the http://zaojiao.com/ site, but not on a local copy

Assertion failure: *(JSObject**)slot == NULL, at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:1587

Program received signal SIGTRAP, Trace/breakpoint trap.
JS_Assert (s=0x3e76fc "*(JSObject**)slot == NULL", file=0x3e72ec "/work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp", ln=1587) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jsutil.cpp:63
63	    abort();
(gdb) bt
#0  JS_Assert (s=0x3e76fc "*(JSObject**)slot == NULL", file=0x3e72ec "/work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp", ln=1587) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jsutil.cpp:63
#1  0x00362051 in NativeToValue (cx=0x1307200, v=@0x17824d54, type=5 '\005', slot=0xbfff9c48) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:1587
#2  0x00362860 in FlushNativeGlobalFrame (cx=0x1307200, ngslots=1, gslots=0x850710, mp=0xbfff9570 "\005?<\001????\b???J?X\v", '?' <repeats 184 times>..., np=0xbfff9580) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:1633
#3  0x0036a9f3 in js_ExecuteTree (cx=0x1307200, f=0xfd1a170, inlineCallCount=@0xbfffc408, innermostNestedGuardp=0xbfffc028) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:4082
#4  0x0038f8ce in js_MonitorLoopEdge (cx=0x1307200, inlineCallCount=@0xbfffc408) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:4195
#5  0x002b5c45 in js_Interpret (cx=0x1307200) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jsinterp.cpp:3687
#6  0x002d2cfa in js_Execute (cx=0x1307200, chain=0x14bef480, script=0x17985200, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1562
#7  0x00262133 in JS_EvaluateUCScriptForPrincipals (cx=0x1307200, obj=0x14bef480, principals=0xf852ec4, chars=0xf62f008, length=4625, filename=0xf852298 "http://zaojiao.com/", lineno=2863, rval=0x0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jsapi.cpp:5242
#8  0x0ba4ebd5 in nsJSContext::EvaluateString (this=0x141edc00, aScript=@0xbfffca34, aScopeObject=0x14bef480, aPrincipal=0xf852ec0, aURL=0xf852298 "http://zaojiao.com/", aLineNo=2863, aVersion=0, aRetValue=0x0, aIsUndefined=0xbfffc9b4) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/dom/src/base/nsJSEnvironment.cpp:1598
#9  0x0b83424e in nsScriptLoader::EvaluateScript (this=0xf854b20, aRequest=0x1cd983b0, aScript=@0xbfffca34) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/base/src/nsScriptLoader.cpp:671
#10 0x0b83461e in nsScriptLoader::ProcessRequest (this=0xf854b20, aRequest=0x1cd983b0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/base/src/nsScriptLoader.cpp:585
#11 0x0b8358b8 in nsScriptLoader::ProcessScriptElement (this=0xf854b20, aElement=0x1cd909d4) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/base/src/nsScriptLoader.cpp:539
#12 0x0b831048 in nsScriptElement::MaybeProcessScript (this=0x1cd909d4) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/base/src/nsScriptElement.cpp:193
#13 0x0b90120d in nsHTMLScriptElement::MaybeProcessScript (this=0x1cd909b0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/html/content/src/nsHTMLScriptElement.cpp:547
#14 0x0b9002ed in nsHTMLScriptElement::DoneAddingChildren (this=0x1cd909b0, aHaveNotified=1) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/html/content/src/nsHTMLScriptElement.cpp:484
#15 0x0b92e7e9 in HTMLContentSink::ProcessSCRIPTEndTag (this=0x10d8600, content=0x1cd909b0, aMalformed=0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp:3134
#16 0x0b930007 in SinkContext::CloseContainer (this=0xf852e30, aTag=eHTMLTag_script, aMalformed=0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp:1023
#17 0x0b9304c5 in HTMLContentSink::CloseContainer (this=0x10d8600, aTag=eHTMLTag_script) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp:2389
#18 0x13c37db8 in CNavDTD::CloseContainer (this=0xf85c410, aTag=eHTMLTag_script, aMalformed=0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:2798
#19 0x13c38b98 in CNavDTD::HandleEndToken (this=0xf85c410, aToken=0x16fd460) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:1677
#20 0x13c3be04 in CNavDTD::HandleToken (this=0xf85c410, aToken=0x16fd460, aParser=0xf8554a0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:761
#21 0x13c3512a in CNavDTD::BuildModel (this=0xf85c410, aParser=0xf8554a0, aTokenizer=0xf85c4d0, anObserver=0x0, aSink=0x10d8690) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:333
#22 0x13c47c59 in nsParser::BuildModel (this=0xf8554a0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:2381
#23 0x13c4bdd9 in nsParser::ResumeParse (this=0xf8554a0, allowIteration=1, aIsFinalChunk=1, aCanInterrupt=1) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:2254
#24 0x13c4c782 in nsParser::ContinueInterruptedParsing (this=0xf8554a0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:1741
#25 0x13c44fb2 in nsParser::HandleParserContinueEvent (this=0xf8554a0, ev=0x1cd96a80) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:1809
#26 0x13c4e17b in nsParserContinueEvent::Run (this=0x1cd96a80) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:161
#27 0x0051f4d8 in nsThread::ProcessNextEvent (this=0x815be0, mayWait=0, result=0xbfffd564) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/xpcom/threads/nsThread.cpp:510
#28 0x004a8ab2 in NS_ProcessPendingEvents_P (thread=0x815be0, timeout=20) at nsThreadUtils.cpp:180
#29 0x099330b9 in nsBaseAppShell::NativeEventCallback (this=0x8351e0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:121
#30 0x098ea31c in nsAppShell::ProcessGeckoEvents (aInfo=0x8351e0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/widget/src/cocoa/nsAppShell.mm:374
#31 0x954565f5 in CFRunLoopRunSpecific ()
#32 0x95456cd8 in CFRunLoopRunInMode ()
#33 0x9094f2c0 in RunCurrentEventLoopInMode ()
#34 0x9094f012 in ReceiveNextEventCommon ()
#35 0x9094ef4d in BlockUntilNextEventMatchingListInMode ()
#36 0x9619cd7d in _DPSNextEvent ()
#37 0x9619c630 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#38 0x9619566b in -[NSApplication run] ()
#39 0x098e82a0 in nsAppShell::Run (this=0x8351e0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/widget/src/cocoa/nsAppShell.mm:693
#40 0x0a5e853e in nsAppStartup::Run (this=0x84eb60) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:192
#41 0x000c21fe in XRE_main (argc=1, argv=0xbfffeaf8, aAppData=0x80ede0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/toolkit/xre/nsAppRunner.cpp:3210
#42 0x000026e3 in main (argc=1, argv=0xbfffeaf8) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/browser/app/nsBrowserApp.cpp:156
(gdb) quit
See also bug 466654 and bug 469254.

/be
WFM on TM branch and mozilla-central.
(In reply to comment #2)
> WFM on TM branch and mozilla-central.

hmmm i can still reproduce this on TM hg id:
271e5fa192fd tip on the live site http://zaojiao.com/

Note: the site need to be loaded completed (including the flash elements)! which take from here 2 minutes or so.
Summary: TM: Assertion failure: *(JSObject**)slot == NULL during Topsite Test → TM: "Assertion failure: *(JSObject**)slot == NULL" on http://zaojiao.com/
I'm an idiot.  I can reproduce on TM branch once I turn the JIT back on.
Flags: blocking1.9.1?
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2
WFM with TM tip. Jesse, can you confirm?
WFM, TM branch.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
No longer depends on: sisyphus-tracking
You need to log in before you can comment on or make changes to this bug.