451899 - TM: opening history in firefox asserts with chrome JIT enabled "Assertion failure: (traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1], at s:/mozilla/mozilla/js/src/jstracer.cpp:1353"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Nickolay_Ponomarev]

STR:
1. New profile, javascript.options.jit.chrome=true
2. History -> Show All History

Actual results: asserts consistently: "Assertion failure: (traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1], at s:/mozilla/mozilla/js/src/jstracer.cpp:1353"

JS_Assert(s=0x0065eae8, file=0x0065eabc, ln=0x00000549)  Line 59	C++
TraceRecorder::snapshot(exitType=MISMATCH_EXIT)  Line 1353	C++
TraceRecorder::guard(expected=false, cond=0x03ab35a0, exitType=MISMATCH_EXIT)  Line 1364	C++
TraceRecorder::prop(obj=JSObject [... slots], obj_ins=0x03ab3520, slot=0x0012a58c, v_ins=0x07e5c328)  Line 4268	C++
TraceRecorder::getProp(obj=JSObject [... slots], obj_ins=0x03ab3520)  Line 4383	C++
TraceRecorder::getProp(v=0x06ef1060)  Line 4399	C++
TraceRecorder::record_JSOP_GETARGPROP()  Line 5595	C++
js_Interpret(cx=0x08adcc70)  Line 508	C++
js_Invoke(cx=0x08adcc70, argc=0x00000001, vp=0x07e5c278, flags=0x00000000)  Line 1326	C++

JS stack:
0 PU_nodeIsFolder(aNode = [xpconnect wrapped nsINavHistoryResultNode @ 0x7bb1d18 (native @ 0x7b0f228)]) ["file:///S:/mozilla/mozilla/obj-fx-debug/dist/bin/modules/utils.js":183]
    this = [object Object]
1 PC__hasRemovableSelection(aIsMoveCommand = true) ["chrome://browser/content/places/controller.js":300]
    parent = undefined
    i = 0
    root = [xpconnect wrapped (nsISupports, nsINavHistoryContainerResultNode, nsINavHistoryQueryResultNode) @ 0x7f05df0 (native @ 0x7dcd970)]
    nodes = [xpconnect wrapped nsINavHistoryResultNode @ 0x7bb1d18 (native @ 0x7b0f228)]
    this = [object Object]
2 PC_isCommandEnabled(aCommand = "placesCmd_moveBookmarks") ["chrome://browser/content/places/controller.js":133]
    selectedNode = undefined
    container = undefined
    result = undefined
    this = [object Object]
3 [native frame]
4 updatePlacesCommand(aCommand = "placesCmd_moveBookmarks") ["chrome://browser/content/places/controller.js":1493]
    enabled = false
    this = [object ChromeWindow @ 0x8bace58 (native @ 0x791043c)]
5 goUpdatePlacesCommands() ["chrome://browser/content/places/controller.js":1505]
    updatePlacesCommand = [function]
    placesController = [xpconnect wrapped nsIController @ 0x7b59408 (native @ 0x803cb70)]
    this = [object ChromeWindow @ 0x8bace58 (native @ 0x791043c)]
6 oncommandupdate(event = [object Event @ 0x7ba3940 (native @ 0x788d128)]) ["chrome://browser/content/places/places.xul":1]
    this = [object XULElement @ 0x7dae048 (native @ 0x60b2d18)]
7 [native frame]
8 PO_init() ["chrome://browser/content/places/places.js":76]
    view = [xpconnect wrapped (nsISupports, nsITreeView, nsINavHistoryResultTreeViewer, nsINavHistoryResultViewer) @ 0x7872dd8 (native @ 0x70f5c78)]
    leftPaneSelection = "History"
    this = [object Object]
9 onload(event = [object Event @ 0x783cb10 (native @ 0x5f195b0)]) ["chrome://browser/content/places/places.xul":1]
    this = [object ChromeWindow @ 0x8bace58 (native @ 0x791043c)]

Comment 1

[Andreas Gal :gal]

Would you mind retesting this with the current nightly build?

Comment 2

[RFLazaro]

No crashes using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080908091724 Minefield/3.1b1pre

Comment 3

[Nickolay_Ponomarev]

Still asserts with a fresh pull (changeset:   19012:af9ae0314398).

Comment 4

[RFLazaro]

I take back comment #2, it still crashes with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080908091724 Minefield/3.1b1pre

Comment 5

[RFLazaro]

Works again with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080909032504 Minefield/3.1b1pre

Note: I deleted the XUL.mfl and XPC.mfl; I think those were causing the crashes

Comment 6

[Brendan Eich [:brendan]]

Fixed by patch for bug 453563.

/be