TM: opening history in firefox asserts with chrome JIT enabled "Assertion failure: (traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1], at s:/mozilla/mozilla/js/src/jstracer.cpp:1353"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
P2
normal
RESOLVED FIXED
10 years ago
10 years ago

People

(Reporter: Nickolay_Ponomarev, Unassigned)

Tracking

({assertion})

Trunk
x86
Windows XP
assertion
Points:
---
Bug Flags:
in-testsuite -
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

10 years ago
STR:
1. New profile, javascript.options.jit.chrome=true
2. History -> Show All History

Actual results: asserts consistently: "Assertion failure: (traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1], at s:/mozilla/mozilla/js/src/jstracer.cpp:1353"

JS_Assert(s=0x0065eae8, file=0x0065eabc, ln=0x00000549)  Line 59	C++
TraceRecorder::snapshot(exitType=MISMATCH_EXIT)  Line 1353	C++
TraceRecorder::guard(expected=false, cond=0x03ab35a0, exitType=MISMATCH_EXIT)  Line 1364	C++
TraceRecorder::prop(obj=JSObject [... slots], obj_ins=0x03ab3520, slot=0x0012a58c, v_ins=0x07e5c328)  Line 4268	C++
TraceRecorder::getProp(obj=JSObject [... slots], obj_ins=0x03ab3520)  Line 4383	C++
TraceRecorder::getProp(v=0x06ef1060)  Line 4399	C++
TraceRecorder::record_JSOP_GETARGPROP()  Line 5595	C++
js_Interpret(cx=0x08adcc70)  Line 508	C++
js_Invoke(cx=0x08adcc70, argc=0x00000001, vp=0x07e5c278, flags=0x00000000)  Line 1326	C++

JS stack:
0 PU_nodeIsFolder(aNode = [xpconnect wrapped nsINavHistoryResultNode @ 0x7bb1d18 (native @ 0x7b0f228)]) ["file:///S:/mozilla/mozilla/obj-fx-debug/dist/bin/modules/utils.js":183]
    this = [object Object]
1 PC__hasRemovableSelection(aIsMoveCommand = true) ["chrome://browser/content/places/controller.js":300]
    parent = undefined
    i = 0
    root = [xpconnect wrapped (nsISupports, nsINavHistoryContainerResultNode, nsINavHistoryQueryResultNode) @ 0x7f05df0 (native @ 0x7dcd970)]
    nodes = [xpconnect wrapped nsINavHistoryResultNode @ 0x7bb1d18 (native @ 0x7b0f228)]
    this = [object Object]
2 PC_isCommandEnabled(aCommand = "placesCmd_moveBookmarks") ["chrome://browser/content/places/controller.js":133]
    selectedNode = undefined
    container = undefined
    result = undefined
    this = [object Object]
3 [native frame]
4 updatePlacesCommand(aCommand = "placesCmd_moveBookmarks") ["chrome://browser/content/places/controller.js":1493]
    enabled = false
    this = [object ChromeWindow @ 0x8bace58 (native @ 0x791043c)]
5 goUpdatePlacesCommands() ["chrome://browser/content/places/controller.js":1505]
    updatePlacesCommand = [function]
    placesController = [xpconnect wrapped nsIController @ 0x7b59408 (native @ 0x803cb70)]
    this = [object ChromeWindow @ 0x8bace58 (native @ 0x791043c)]
6 oncommandupdate(event = [object Event @ 0x7ba3940 (native @ 0x788d128)]) ["chrome://browser/content/places/places.xul":1]
    this = [object XULElement @ 0x7dae048 (native @ 0x60b2d18)]
7 [native frame]
8 PO_init() ["chrome://browser/content/places/places.js":76]
    view = [xpconnect wrapped (nsISupports, nsITreeView, nsINavHistoryResultTreeViewer, nsINavHistoryResultViewer) @ 0x7872dd8 (native @ 0x70f5c78)]
    leftPaneSelection = "History"
    this = [object Object]
9 onload(event = [object Event @ 0x783cb10 (native @ 0x5f195b0)]) ["chrome://browser/content/places/places.xul":1]
    this = [object ChromeWindow @ 0x8bace58 (native @ 0x791043c)]

Comment 1

10 years ago
Would you mind retesting this with the current nightly build?
Blocks: 453668
No longer blocks: 451602
Severity: critical → normal

Comment 2

10 years ago
No crashes using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080908091724 Minefield/3.1b1pre
(Reporter)

Comment 3

10 years ago
Still asserts with a fresh pull (changeset:   19012:af9ae0314398).

Comment 4

10 years ago
I take back comment #2, it still crashes with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080908091724 Minefield/3.1b1pre

Comment 5

10 years ago
Works again with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080909032504 Minefield/3.1b1pre

Note: I deleted the XUL.mfl and XPC.mfl; I think those were causing the crashes

Updated

10 years ago
Priority: -- → P2
Fixed by patch for bug 453563.

/be
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED

Updated

10 years ago
Flags: in-testsuite-
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.