417785 - Crash in js_GetSlotThreadSafe: JS_ASSERT(title->ownercx != cx) @ jslock.c:586

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Sebastian Redl]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.11) Gecko/20080207 Firefox/2.0.0.11
Build Identifier: Custom Trunk Build (details below)

This is a custom trunk build of Firefox. CVS checkout as of about 19:00 CET today, that's 18:00 GMT.

After today's update, my new build crashes consistently during opening the second tab/window (first crash when I had a browser window open and opened ChatZilla, now it tries to open two tabs at startup and crashes immediately).

My mozconfig:

-------------------------
# This is a Firefox build.
. $topsrcdir/browser/config/mozconfig

mk_add_options MOZ_OBJDIR=$topsrcdir/obj-firefox

# This is a debug build.
ac_add_options --disable-optimize --enable-debug
ac_add_options --disable-reorder --enable-debugger-info-module=ALL_MODULES
ac_add_options --disable-strip --disable-install-strip

ac_add_options --enable-default-toolkit=cairo-gtk2
ac_add_options --disable-static --enable-shared --enable-libxul

# Docs are a bit unclear on whether this is off by default.
ac_add_options --enable-crypto

ac_add_options --enable-official-branding
-------------------------

Platform is Linux x86-64, GCC 4.1.1.

I don't believe this is a dupe of the existing crashers in js_GetSlotThreadSafe, as these seem to occur earlier. Oh, and they're release build, so they probably don't assert.

Partial stack trace follows. I have 49 more frames if they might be helpful.

-------------------------
#0  0x00002b27208ce1b1 in nanosleep () from /lib/libc.so.6
#1  0x00002b27208cdfd4 in sleep () from /lib/libc.so.6
#2  0x00002b271cf9bb44 in ah_crap_handler (signum=6) at nsSigHandlers.cpp:149
#3  0x00002b271cfb34e9 in nsProfileLock::FatalSignalHandler (signo=6) at nsProfileLock.cpp:216
#4  <signal handler called>
#5  0x00002b272086c8d5 in raise () from /lib/libc.so.6
#6  0x00002b272086db6e in abort () from /lib/libc.so.6
#7  0x00002b271ead3cc1 in JS_Assert (s=0x2b271eb002c4 "title->ownercx != cx", 
    file=0x2b271eb00218 "/home/wasti/projects/mozilla/js/src/jslock.c", ln=586)
    at /home/wasti/projects/mozilla/js/src/jsutil.c:63
#8  0x00002b271ea70618 in js_GetSlotThreadSafe (cx=0x17605f0, obj=0x2aaaad5d6e00, slot=43)
    at /home/wasti/projects/mozilla/js/src/jslock.c:586
#9  0x00002b271d023f86 in XPCWrapper::NewResolve (cx=0x17605f0, wrapperObj=0x2aaaad5ded80, innerObj=0x2aaaad5d6e00, 
    id=46912496132404, flags=1, objp=0x7fff8e18de50, preserveVal=0)
    at /home/wasti/projects/mozilla/js/src/xpconnect/src/XPCWrapper.cpp:313
#10 0x00002b271d0221dd in XPC_XOW_NewResolve (cx=0x17605f0, obj=0x2aaaad5ded80, id=46912496132404, flags=1, 
    objp=0x7fff8e18de50) at /home/wasti/projects/mozilla/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp:824
#11 0x00002b271ea7ed2b in js_LookupPropertyWithFlags (cx=0x17605f0, obj=0x2aaaad5ded80, id=46912496132404, flags=1, 
    objp=0x7fff8e18df50, propp=0x7fff8e18df48) at /home/wasti/projects/mozilla/js/src/jsobj.c:3265
#12 0x00002b271ea80639 in js_GetPropertyHelper (cx=0x17605f0, obj=0x2aaaad5ded80, id=46912496132404, vp=0x7fff8e18e698, 
    entryp=0x0) at /home/wasti/projects/mozilla/js/src/jsobj.c:3581
#13 0x00002b271ea809ee in js_GetProperty (cx=0x17605f0, obj=0x2aaaad5ded80, id=46912496132404, vp=0x7fff8e18e698)
    at /home/wasti/projects/mozilla/js/src/jsobj.c:3660
#14 0x00002b271ea5eae2 in js_Interpret (cx=0x17605f0, pc=0xb43522 "7\005A\210", result=0x7fff8e18ec98)
    at /home/wasti/projects/mozilla/js/src/jsinterp.c:4359
#15 0x00002b271ea4752d in js_Invoke (cx=0x17605f0, argc=1, vp=0x17b5198, flags=2)
    at /home/wasti/projects/mozilla/js/src/jsinterp.c:1396
#16 0x00002b271ea47849 in js_InternalInvoke (cx=0x17605f0, obj=0x2aaaad5d6e00, fval=46912541420864, flags=0, argc=1, 
    argv=0x7fff8e18ef30, rval=0x7fff8e18ef28) at /home/wasti/projects/mozilla/js/src/jsinterp.c:1452
#17 0x00002b271ea00874 in JS_CallFunctionValue (cx=0x17605f0, obj=0x2aaaad5d6e00, fval=46912541420864, argc=1, 
    argv=0x7fff8e18ef30, rval=0x7fff8e18ef28) at /home/wasti/projects/mozilla/js/src/jsapi.c:4964
#18 0x00002b271d01f98d in XPC_SJOW_GetOrSetProperty (cx=0x17605f0, obj=0x2aaaad5deb40, id=46912496132404, vp=0x7fff8e18f7d8, 
    aIsSet=0) at /home/wasti/projects/mozilla/js/src/xpconnect/src/XPCSafeJSObjectWrapper.cpp:587
#19 0x00002b271d01fa37 in XPC_SJOW_GetProperty (cx=0x17605f0, obj=0x2aaaad5deb40, id=46912496132404, vp=0x7fff8e18f7d8)
    at /home/wasti/projects/mozilla/js/src/xpconnect/src/XPCSafeJSObjectWrapper.cpp:595
#20 0x00002b271ea7fab2 in js_NativeGet (cx=0x17605f0, obj=0x2aaaad5deb40, pobj=0x2aaaad5deb40, sprop=0x1a2dac8, 
    vp=0x7fff8e18f7d8) at /home/wasti/projects/mozilla/js/src/jsobj.c:3497
#21 0x00002b271ea80932 in js_GetPropertyHelper (cx=0x17605f0, obj=0x2aaaad5deb40, id=46912496132404, vp=0x7fff8e18f7d8, 
    entryp=0x7fff8e18f5f0) at /home/wasti/projects/mozilla/js/src/jsobj.c:3646
#22 0x00002b271ea5ada4 in js_Interpret (cx=0x17605f0, pc=0x184b7cc "�", result=0x7fff8e18fdd8)
    at /home/wasti/projects/mozilla/js/src/jsinterp.c:4063
#23 0x00002b271ea4752d in js_Invoke (cx=0x17605f0, argc=4, vp=0x17b50d0, flags=2)
    at /home/wasti/projects/mozilla/js/src/jsinterp.c:1396
#24 0x00002b271d000f51 in nsXPCWrappedJSClass::CallMethod (this=0x14ae510, wrapper=0x1549d00, methodIndex=3, info=0x6404c0, 
    nativeParams=0x7fff8e1904a0) at /home/wasti/projects/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1473
#25 0x00002b271cff87ed in nsXPCWrappedJS::CallMethod (this=0x1549d00, methodIndex=3, info=0x6404c0, params=0x7fff8e1904a0)
    at /home/wasti/projects/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:556
#26 0x00002b271df0b698 in PrepareAndDispatch (self=0xb71660, methodIndex=3, args=0x7fff8e190620, gpregs=0x7fff8e1905a0, 
    fpregs=0x7fff8e1905d0) at /home/wasti/projects/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_64_linux.cpp:151
#27 0x00002b271df0a71b in SharedStub () from ./libxul.so
#28 0x00002b271da8bf4a in nsDocLoader::FireOnStateChange (this=0x1603b60, aProgress=0x1603b88, aRequest=0x1839c70, 
    aStateFlags=786448, aStatus=2152398850) at /home/wasti/projects/mozilla/uriloader/base/nsDocLoader.cpp:1235


Reproducible: Always

Comment 1

[Sebastian Redl]

Hmm, trying a clean build doesn't work at all:

gmake[4]: *** No rule to make target `/home/wasti/projects/mozilla-alt/accessible/tests/Makefile.in', needed by `tests/Makefile'.  Stop.
gmake[4]: Leaving directory `/home/wasti/projects/mozilla/obj-firefox/accessible'
gmake[3]: *** [export_tier_gecko] Error 2
gmake[3]: Leaving directory `/home/wasti/projects/mozilla/obj-firefox'
gmake[2]: *** [tier_gecko] Error 2
gmake[2]: Leaving directory `/home/wasti/projects/mozilla/obj-firefox'
make[1]: *** [default] Error 2
make[1]: Leaving directory `/home/wasti/projects/mozilla/obj-firefox'
make: *** [build] Error 2

Comment 2

[Sebastian Redl]

OK, that was due to the top-level directory not being called "mozilla". Sorry for the spam.

Comment 3

[Sebastian Redl]

Crash does not occur on a clean build.