Closed
Bug 418018
Opened 18 years ago
Closed 18 years ago
Assertion failure: PCVAL_TO_OBJECT(entry->vword) == JSVAL_TO_OBJECT(v_), at jsinterp.c:4125
Categories
(Core :: JavaScript Engine, defect, P2)
Tracking
()
VERIFIED
WORKSFORME
People
(Reporter: martijn.martijn, Assigned: brendan)
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
1.60 KB,
text/html
|
Details |
See testcase, I get this assertion (with backtrace) with the testcase, after 1 second with current debug trunk build:
Assertion failure: PCVAL_TO_OBJECT(entry->vword) == JSVAL_TO_OBJECT(v_), at c:/mozilla-build/mozilla/js/src/jsinterp.c:4125
ntdll.dll!_DbgBreakPoint@0()
> js3250.dll!JS_Assert(const char * s=0x00af1fb8, const char * file=0x00af1f8c, int ln=4125) Line 59 C
js3250.dll!js_Interpret(JSContext * cx=0x06002a38, unsigned char * pc=0x04eb903b, long * result=0x0012f510) Line 4125 + 0x48f bytes C
js3250.dll!js_Invoke(JSContext * cx=0x06002a38, unsigned int argc=2, long * vp=0x04edc9b0, unsigned int flags=2) Line 1396 + 0x13 bytes C
js3250.dll!js_InternalInvoke(JSContext * cx=0x06002a38, JSObject * obj=0x06de2a40, long fval=118634720, unsigned int flags=0, unsigned int argc=2, long * argv=0x04e9f900, long * rval=0x0012f628) Line 1452 + 0x18 bytes C
js3250.dll!JS_CallFunctionValue(JSContext * cx=0x06002a38, JSObject * obj=0x06de2a40, long fval=118634720, unsigned int argc=2, long * argv=0x04e9f900, long * rval=0x0012f628) Line 4964 + 0x1f bytes C
gklayout.dll!nsJSContext::CallEventHandler(nsISupports * aTarget=0x04eea4d0, void * aScope=0x06de2a40, void * aHandler=0x071238e0, nsIArray * aargv=0x04eb913c, nsIVariant * * arv=0x0012f6e0) Line 1941 + 0x24 bytes C++
gklayout.dll!nsGlobalWindow::RunTimeout(nsTimeout * aTimeout=0x04c29e50) Line 7664 + 0xab bytes C++
gklayout.dll!nsGlobalWindow::TimerCallback(nsITimer * aTimer=0x04c29ec0, void * aClosure=0x04c29e50) Line 7998 C++
xpcom_core.dll!nsTimerImpl::Fire() Line 400 + 0xe bytes C++
xpcom_core.dll!nsTimerEvent::Run() Line 490 C++
xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012f848) Line 511 C++
xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x012b5550, int mayWait=1) Line 227 + 0x16 bytes C++
gkwidget.dll!nsBaseAppShell::Run() Line 151 + 0xc bytes C++
tkitcmps.dll!nsAppStartup::Run() Line 181 + 0x1c bytes C++
xul.dll!XRE_main(int argc=1, char * * argv=0x003ff500, const nsXREAppData * aAppData=0x003faf20) Line 3149 + 0x25 bytes C++
firefox.exe!NS_internal_main(int argc=1, char * * argv=0x003ff500) Line 158 + 0x12 bytes C++
firefox.exe!wmain(int argc=1, unsigned short * * argv=0x003f9e48) Line 87 + 0xd bytes C++
firefox.exe!__tmainCRTStartup() Line 583 + 0x19 bytes C
firefox.exe!wmainCRTStartup() Line 403 C
kernel32.dll!_BaseProcessStart@4() + 0x23 bytes
And after that, I crash in my debug build.
I don't crash in normal builds.
My debug build was updated after bug 417012 was fixed.
Both of the iframe contents are the same and consist of this source:
<html><head></head><body>
<embed id="c" type="application/x-shockwave-flash" src="data:application/x-shockwave-flash;charset=utf-8," style="position: fixed;">
<script>
function doe2() {
document.getElementById('c').setAttribute('style', '');
document.body.offsetHeight;
document.getElementById('c').setAttribute('style', '');
}
setTimeout(doe2,500,0);
</script>
</body></html>
|
Reporter | |
Comment 2•18 years ago
|
||
My guess is that this this also is somehow the cause of the xpcom cycle collector crashes I'm seeing when testing with flash plugins.
|
||
Updated•18 years ago
|
Flags: tracking1.9? → blocking1.9?
|
||
Comment 3•18 years ago
|
||
Blocking until investigated.
Assignee: general → brendan
Flags: blocking1.9? → blocking1.9+
Priority: -- → P2
|
|
Assignee | |
Comment 4•18 years ago
|
||
This WFM. Please reopen with test that reproduces if there's still a problem. Thanks,
/be
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → WORKSFORME
|
|
Reporter | |
Updated•18 years ago
|
Status: RESOLVED → VERIFIED
You need to log in
before you can comment on or make changes to this bug.
Description
•