Closed Bug 454590 Opened 12 years ago Closed 12 years ago

TM: Crash using the bookmark/history sidebar [@ TraceRecorder::record_SetPropHit ]

Categories

(Core :: JavaScript Engine, defect, P2, critical)

x86
Windows XP
defect

Tracking

()

RESOLVED DUPLICATE of bug 454744
mozilla1.9.1

People

(Reporter: polidobj, Assigned: brendan)

References

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

With Chrome jit enabled I'm crashing using the bookmarks sidebar.  I crash just when opening the sidebar.  But I think that because I have a folder already expanded.  So if it doesn't crash from just opening try expanding a folder. 
bp-dbfe21d9-7f3e-11dd-9134-001a4bd43ef6
bp-b8568d35-7f3d-11dd-b657-001cc45a2ce4
History side bar is affected too.
Summary: TM: Crash using the bookmark sidebar [@ TraceRecorder::record_SetPropHit ] → TM: Crash using the bookmark/history sidebar [@ TraceRecorder::record_SetPropHit ]
This just started with today's build:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080910043000 Minefield/3.1b1pre (.NET CLR 3.5.30729) ID:20080910043000
http://crash-stats.mozilla.com/report/index/2f6f21f0-7f5a-11dd-ad1b-001a4bd43e5c

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080910082744 Firefox/2.0.0.11 ID:20080910082744
(In reply to comment #3)
Hourly builds don't have symbols so crash reports from them are not really useful.
Priority: -- → P2
Target Milestone: --- → mozilla1.9.1b1
Target Milestone: mozilla1.9.1b1 → mozilla1.9.1
Attached file Stacktrace
May be covered by bug 454689... Taking to debug, will fix today.

/be
Assignee: general → brendan
Both bookmarks and history sidebars both this assertion for me:

Program received signal SIGTRAP, Trace/breakpoint trap.
JS_Assert (s=0x23111840 "(traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1]", file=0x23110d68 "jstracer.cpp", ln=1594) at jsutil.cpp:63
63          abort();
(gdb) bt
#0  JS_Assert (s=0x23111840 "(traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1]", file=0x23110d68 "jstracer.cpp", ln=1594) at jsutil.cpp:63
#1  0x230ca8a0 in TraceRecorder::snapshot (this=0x1c963c60, exitType=MISMATCH_EXIT) at jstracer.cpp:1592
#2  0x230cab67 in TraceRecorder::guard (this=0x1c963c60, expected=0, cond=0x2206465c, exitType=MISMATCH_EXIT) at jstracer.cpp:1605
#3  0x230cfe16 in TraceRecorder::prop (this=0x1c963c60, obj=0x1be65220, obj_ins=0x220645cc, slot=@0xbfff977c, v_ins=@0xbfff9778) at jstracer.cpp:4995
#4  0x230d0325 in TraceRecorder::getProp (this=0x1c963c60, obj=0x1be65220, obj_ins=0x220645cc) at jstracer.cpp:5127
#5  0x230d0479 in TraceRecorder::getProp (this=0x1c963c60, v=@0x2a221608) at jstracer.cpp:5142
#6  0x230d9f3f in TraceRecorder::record_JSOP_GETARGPROP (this=0x1c963c60) at jstracer.cpp:6415
#7  0x2305eb4d in js_Interpret (cx=0x1bf20e00) at jsopcode.tbl:508

This assertion is the topic of bug 453563 (at least).

I'll try disabling it and see if that reaches the record_SetPropHit crash.

/be
Seems fixed by patch for bug 454744.

I'm also patching bug 454689, so if you still see crashes like the one attached by Brad in comment 5, check bug 454689 and try its patch if it hasn't landed and you are building your own. Thanks,

/be
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 454744
Crash Signature: [@ TraceRecorder::record_SetPropHit ]
You need to log in before you can comment on or make changes to this bug.