454590 - TM: Crash using the bookmark/history sidebar [@ TraceRecorder::record_SetPropHit ]

Status: RESOLVED DUPLICATE of bug 454744

(Core :: JavaScript Engine, defect, P2)

Description

[Brian Polidoro]

With Chrome jit enabled I'm crashing using the bookmarks sidebar.  I crash just when opening the sidebar.  But I think that because I have a folder already expanded.  So if it doesn't crash from just opening try expanding a folder. 
bp-dbfe21d9-7f3e-11dd-9134-001a4bd43ef6
bp-b8568d35-7f3d-11dd-b657-001cc45a2ce4

Comment 1

[Brian Polidoro]

History side bar is affected too.

Comment 2

[Brian Polidoro]

This just started with today's build:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080910043000 Minefield/3.1b1pre (.NET CLR 3.5.30729) ID:20080910043000

Comment 3

[IU]

http://crash-stats.mozilla.com/report/index/2f6f21f0-7f5a-11dd-ad1b-001a4bd43e5c

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080910082744 Firefox/2.0.0.11 ID:20080910082744

Comment 4

[Brian Polidoro]

(In reply to comment #3)
Hourly builds don't have symbols so crash reports from them are not really useful.

Comment 5

[Brad Jackson]

Attachment: Stacktrace

Comment 6

[Brendan Eich [:brendan]]

May be covered by bug 454689... Taking to debug, will fix today.

/be

Comment 7

[Brendan Eich [:brendan]]

Both bookmarks and history sidebars both this assertion for me:

Program received signal SIGTRAP, Trace/breakpoint trap.
JS_Assert (s=0x23111840 "(traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1]", file=0x23110d68 "jstracer.cpp", ln=1594) at jsutil.cpp:63
63          abort();
(gdb) bt
#0  JS_Assert (s=0x23111840 "(traceMonitor->globalSlots->data()[n]) < (uint32)(globalObj)->dslots[-1]", file=0x23110d68 "jstracer.cpp", ln=1594) at jsutil.cpp:63
#1  0x230ca8a0 in TraceRecorder::snapshot (this=0x1c963c60, exitType=MISMATCH_EXIT) at jstracer.cpp:1592
#2  0x230cab67 in TraceRecorder::guard (this=0x1c963c60, expected=0, cond=0x2206465c, exitType=MISMATCH_EXIT) at jstracer.cpp:1605
#3  0x230cfe16 in TraceRecorder::prop (this=0x1c963c60, obj=0x1be65220, obj_ins=0x220645cc, slot=@0xbfff977c, v_ins=@0xbfff9778) at jstracer.cpp:4995
#4  0x230d0325 in TraceRecorder::getProp (this=0x1c963c60, obj=0x1be65220, obj_ins=0x220645cc) at jstracer.cpp:5127
#5  0x230d0479 in TraceRecorder::getProp (this=0x1c963c60, v=@0x2a221608) at jstracer.cpp:5142
#6  0x230d9f3f in TraceRecorder::record_JSOP_GETARGPROP (this=0x1c963c60) at jstracer.cpp:6415
#7  0x2305eb4d in js_Interpret (cx=0x1bf20e00) at jsopcode.tbl:508

This assertion is the topic of bug 453563 (at least).

I'll try disabling it and see if that reaches the record_SetPropHit crash.

/be

Comment 8

[Brendan Eich [:brendan]]

Seems fixed by patch for bug 454744.

I'm also patching bug 454689, so if you still see crashes like the one attached by Brad in comment 5, check bug 454689 and try its patch if it hasn't landed and you are building your own. Thanks,

/be