460980 - TM: Assertion failure: JSVAL_TAG(v) == JSVAL_STRING @NativeToValue in js1_7/regress/regress-452703.js

Status: RESOLVED DUPLICATE of bug 459630

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

bug 452703

Steps to reproduce:

  cd js/tests
  ../src/Darwin_DBG.OBJ/js -f shell.js -f js1_7/shell.js \
      -f js1_7/regress/regress-452703.js

  BUGNUMBER: 452703
  STATUS: Do not assert with JIT: rmask(rr)&FpRegs
  Assertion failure: JSVAL_TAG(v) == JSVAL_STRING, at jstracer.cpp:1334
  Trace/BPT trap

In the debugger:

patching jump at 0x260fcf to target 0x25ff2d (was 0x25fffc)

recording completed at /Users/jason/dev/moz/tracemonkey/js/tests/js1_7/regress/regress-452703.js:50@29 via closeLoop
entering trace at /Users/jason/dev/moz/tracemonkey/js/tests/js1_7/regress/regress-452703.js:50@29, native stack slots: 6 code: 0x25ff20
global: double<nan> 
stack: callee0=object<0x25bf18:Function> this0=object<0x0:null> stack0=double<nan> stack1=object<0x257580:Iterator> 
leaving trace at /Users/jason/dev/moz/tracemonkey/js/tests/js1_7/regress/regress-452703.js:50@29, op=forlocal, lr=0x260f3c, exitType=3, sp=2, ip=0x260f37, calldepth=0, cycles=33836
double<nan> 
callee0=object<0x25bf18:Function> this0=object<0x0:null> stack0=double<nan> stack1=object<0x257580:Iterator> 
entering trace at /Users/jason/dev/moz/tracemonkey/js/tests/js1_7/regress/regress-452703.js:50@29, native stack slots: 6 code: 0x25ff20
global: double<nan> 
stack: callee0=object<0x25bf18:Function> this0=object<0x0:null> stack0=double<nan> stack1=object<0x257580:Iterator> 
leaving trace at /Users/jason/dev/moz/tracemonkey/js/tests/js1_7/regress/regress-452703.js:50@32, op=ifeq, lr=0x260f88, exitType=1, sp=3, ip=0x260f83, calldepth=0, cycles=15037
double<nan> 
Assertion failure: JSVAL_TAG(v) == JSVAL_STRING, at jstracer.cpp:1334

Program received signal SIGTRAP, Trace/breakpoint trap.
JS_Assert (s=0x18b289 "JSVAL_TAG(v) == JSVAL_STRING", file=0x18ae39 "jstracer.cpp", ln=1334) at jsutil.cpp:63
63	    abort();
(gdb) where
#0  JS_Assert (s=0x18b289 "JSVAL_TAG(v) == JSVAL_STRING", file=0x18ae39 "jstracer.cpp", ln=1334) at jsutil.cpp:63
#1  0x0011ed72 in NativeToValue (cx=0x3010f0, v=@0x80f4bc, type=4 '\004', slot=0xbfffa410) at jstracer.cpp:1334
#2  0x0011fabb in FlushNativeStackFrame (cx=0x3010f0, callDepth=0, mp=0x25e196 "\004", np=0xbfffa410, stopFrame=0x0) at jstracer.cpp:1422
#3  0x00126182 in js_ExecuteTree (cx=0x3010f0, treep=0xbfffcd94, inlineCallCount=@0xbfffd978, innermostNestedGuardp=0xbfffcd90) at jstracer.cpp:2806
#4  0x0013804b in js_MonitorLoopEdge (cx=0x3010f0, inlineCallCount=@0xbfffd978) at jstracer.cpp:2867
#5  0x00062348 in js_Interpret (cx=0x3010f0) at jsinterp.cpp:3062
#6  0x00099526 in js_Execute (cx=0x3010f0, chain=0x257000, script=0x3075e0, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1550
#7  0x00018a78 in JS_ExecuteScript (cx=0x3010f0, obj=0x257000, script=0x3075e0, rval=0x0) at jsapi.cpp:4982
#8  0x000025e2 in Process (cx=0x3010f0, obj=0x257000, filename=0xbffff86f "/Users/jason/dev/moz/tracemonkey/js/tests/js1_7/regress/regress-452703.js", forceTTY=0) at js.cpp:277
#9  0x00007e62 in ProcessArgs (cx=0x3010f0, obj=0x257000, argv=0xbffff744, argc=7) at js.cpp:575
#10 0x00008fd8 in main (argc=7, argv=0xbffff744, envp=0xbffff764) at js.cpp:3989
(gdb) select 1
(gdb) print v
$1 = (jsval &) @0x80f4bc: -1
(gdb) x/8x 0x80f4b0
0x80f4b0:	0x0080f44c	0x00000000	0x000000aa	0xffffffff
0x80f4c0:	0x00257580	0x002630f2	0x00000009	0xdadadada

Comment 1

[Bob Clary [:bc] (inactive)]

dupe of bug 459630 comment 1 ?