Closed Bug 454590 Opened 12 years ago Closed 12 years ago
TM: Crash using the bookmark/history sidebar [@ Trace
Recorder::record _Set Prop Hit ]
With Chrome jit enabled I'm crashing using the bookmarks sidebar. I crash just when opening the sidebar. But I think that because I have a folder already expanded. So if it doesn't crash from just opening try expanding a folder. bp-dbfe21d9-7f3e-11dd-9134-001a4bd43ef6 bp-b8568d35-7f3d-11dd-b657-001cc45a2ce4
History side bar is affected too.
Summary: TM: Crash using the bookmark sidebar [@ TraceRecorder::record_SetPropHit ] → TM: Crash using the bookmark/history sidebar [@ TraceRecorder::record_SetPropHit ]
This just started with today's build: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080910043000 Minefield/3.1b1pre (.NET CLR 3.5.30729) ID:20080910043000
http://crash-stats.mozilla.com/report/index/2f6f21f0-7f5a-11dd-ad1b-001a4bd43e5c Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080910082744 Firefox/184.108.40.206 ID:20080910082744
(In reply to comment #3) Hourly builds don't have symbols so crash reports from them are not really useful.
May be covered by bug 454689... Taking to debug, will fix today. /be
Assignee: general → brendan
Both bookmarks and history sidebars both this assertion for me: Program received signal SIGTRAP, Trace/breakpoint trap. JS_Assert (s=0x23111840 "(traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1]", file=0x23110d68 "jstracer.cpp", ln=1594) at jsutil.cpp:63 63 abort(); (gdb) bt #0 JS_Assert (s=0x23111840 "(traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1]", file=0x23110d68 "jstracer.cpp", ln=1594) at jsutil.cpp:63 #1 0x230ca8a0 in TraceRecorder::snapshot (this=0x1c963c60, exitType=MISMATCH_EXIT) at jstracer.cpp:1592 #2 0x230cab67 in TraceRecorder::guard (this=0x1c963c60, expected=0, cond=0x2206465c, exitType=MISMATCH_EXIT) at jstracer.cpp:1605 #3 0x230cfe16 in TraceRecorder::prop (this=0x1c963c60, obj=0x1be65220, obj_ins=0x220645cc, slot=@0xbfff977c, v_ins=@0xbfff9778) at jstracer.cpp:4995 #4 0x230d0325 in TraceRecorder::getProp (this=0x1c963c60, obj=0x1be65220, obj_ins=0x220645cc) at jstracer.cpp:5127 #5 0x230d0479 in TraceRecorder::getProp (this=0x1c963c60, v=@0x2a221608) at jstracer.cpp:5142 #6 0x230d9f3f in TraceRecorder::record_JSOP_GETARGPROP (this=0x1c963c60) at jstracer.cpp:6415 #7 0x2305eb4d in js_Interpret (cx=0x1bf20e00) at jsopcode.tbl:508 This assertion is the topic of bug 453563 (at least). I'll try disabling it and see if that reaches the record_SetPropHit crash. /be
Seems fixed by patch for bug 454744. I'm also patching bug 454689, so if you still see crashes like the one attached by Brad in comment 5, check bug 454689 and try its patch if it hasn't landed and you are building your own. Thanks, /be
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 454744
Crash Signature: [@ TraceRecorder::record_SetPropHit ]
You need to log in before you can comment on or make changes to this bug.