Closed Bug 462980 Opened 16 years ago Closed 16 years ago

Assertion failure opening email in GMail

Categories

(Core :: JavaScript Engine, defect, P1)

x86
macOS
defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: roc, Assigned: gal)

Details

(Keywords: assertion, dogfood)

Trunk build, ID 20081104.

GMail opens via Session Restore. I click on an email in my Bugzilla to open it. Results:

Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:1767

Program received signal SIGTRAP, Trace/breakpoint trap.
JS_Assert (s=0x35e560 "(m != JSVAL_INT) || isInt32(*vp)", file=0x35dd54 "/Users/roc/mozilla-checkin/js/src/jstracer.cpp", ln=1767) at /Users/roc/mozilla-checkin/js/src/jsutil.cpp:63
63	    abort();
(gdb) where
#0  JS_Assert (s=0x35e560 "(m != JSVAL_INT) || isInt32(*vp)", file=0x35dd54 "/Users/roc/mozilla-checkin/js/src/jstracer.cpp", ln=1767) at /Users/roc/mozilla-checkin/js/src/jsutil.cpp:63
#1  0x002f65f4 in TraceRecorder::determineSlotType (this=0x1030f420, vp=0xddc0f6c) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:1767
#2  0x002fecb1 in TraceRecorder::snapshot (this=0x1030f420, exitType=nanojit::OOM_EXIT) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:1809
#3  0x002ffa28 in TraceRecorder::guard (this=0x1030f420, expected=false, cond=0x80c5568, exitType=nanojit::OOM_EXIT) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:1902
#4  0x003017b2 in TraceRecorder::box_jsval (this=0x1030f420, v=261067426, v_ins=@0xbffed7d0) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:4027
#5  0x00307094 in TraceRecorder::record_JSOP_SETELEM (this=0x1030f420) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:5266
#6  0x00259578 in js_Interpret (cx=0x21a29c00) at jsopcode.tbl:164
#7  0x0026c05c in js_Invoke (cx=0x21a29c00, argc=0, vp=0xddc07c8, flags=0) at jsinterp.cpp:1324
#8  0x00226afc in fun_call (cx=0x21a29c00, argc=0, vp=0xddc07b4) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1643
#9  0x00247b15 in js_Interpret (cx=0x21a29c00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4998
#10 0x0026c05c in js_Invoke (cx=0x21a29c00, argc=0, vp=0xddc0720, flags=0) at jsinterp.cpp:1324
#11 0x00226afc in fun_call (cx=0x21a29c00, argc=0, vp=0xddc070c) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1643
#12 0x00247b15 in js_Interpret (cx=0x21a29c00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4998
#13 0x0026c05c in js_Invoke (cx=0x21a29c00, argc=0, vp=0xddc06fc, flags=0) at jsinterp.cpp:1324
#14 0x00226ea6 in js_fun_apply (cx=0x21a29c00, argc=0, vp=0xddc06e4) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1732
#15 0x00247b15 in js_Interpret (cx=0x21a29c00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4998
#16 0x0026c05c in js_Invoke (cx=0x21a29c00, argc=1, vp=0xddc0648, flags=0) at jsinterp.cpp:1324
#17 0x00226afc in fun_call (cx=0x21a29c00, argc=1, vp=0xddc0630) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1643
#18 0x00247b15 in js_Interpret (cx=0x21a29c00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4998
#19 0x0026c05c in js_Invoke (cx=0x21a29c00, argc=1, vp=0xddc03c4, flags=0) at jsinterp.cpp:1324
#20 0x00226afc in fun_call (cx=0x21a29c00, argc=1, vp=0xddc03ac) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1643
#21 0x00247b15 in js_Interpret (cx=0x21a29c00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4998
#22 0x0026c05c in js_Invoke (cx=0x21a29c00, argc=1, vp=0xddc0204, flags=0) at jsinterp.cpp:1324
#23 0x00226afc in fun_call (cx=0x21a29c00, argc=1, vp=0xddc01ec) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1643
#24 0x00247b15 in js_Interpret (cx=0x21a29c00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4998
#25 0x0026c05c in js_Invoke (cx=0x21a29c00, argc=2, vp=0xddc00a4, flags=0) at jsinterp.cpp:1324
#26 0x00226ea6 in js_fun_apply (cx=0x21a29c00, argc=2, vp=0xddc008c) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1732
#27 0x00247b15 in js_Interpret (cx=0x21a29c00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4998
#28 0x0026c05c in js_Invoke (cx=0x21a29c00, argc=2, vp=0xddc007c, flags=0) at jsinterp.cpp:1324
#29 0x00226ea6 in js_fun_apply (cx=0x21a29c00, argc=2, vp=0xddc005c) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1732
#30 0x00247b15 in js_Interpret (cx=0x21a29c00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4998
#31 0x0026c05c in js_Invoke (cx=0x21a29c00, argc=2, vp=0xddc0048, flags=0) at jsinterp.cpp:1324
#32 0x00226afc in fun_call (cx=0x21a29c00, argc=2, vp=0xddc002c) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1643
#33 0x00247b15 in js_Interpret (cx=0x21a29c00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4998
#34 0x0026c05c in js_Invoke (cx=0x21a29c00, argc=1, vp=0xddc0020, flags=0) at jsinterp.cpp:1324
#35 0x00d19414 in nsXPCWrappedJSClass::CallMethod (this=0xcb50c90, wrapper=0x20bc3330, methodIndex=3, info=0x1581500, nativeParams=0xbfffc624) at /Users/roc/mozilla-checkin/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1549
#36 0x00d1152f in nsXPCWrappedJS::CallMethod (this=0x20bc3330, methodIndex=3, info=0x1581500, params=0xbfffc624) at /Users/roc/mozilla-checkin/js/src/xpconnect/src/xpcwrappedjs.cpp:563
#37 0x0049f378 in PrepareAndDispatch (self=0x20bc32e0, methodIndex=3, args=0xbfffc744) at /Users/roc/mozilla-checkin/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
#38 0x0049f3d7 in nsXPTCStubBase::Stub3 (this=0x20bc32e0) at xptcstubsdef.inc:1
#39 0x034f652b in nsEventListenerManager::HandleEventSubType (this=0x20bc3780, aListenerStruct=0x20bc37a8, aListener=0x20bc32e0, aDOMEvent=0x9016fb0, aCurrentTarget=0x20ba97b0, aPhaseFlags=6) at /Users/roc/mozilla-checkin/content/events/src/nsEventListenerManager.cpp:1091
#40 0x034f80bc in nsEventListenerManager::HandleEvent (this=0x20bc3780, aPresContext=0x0, aEvent=0xbfffcabc, aDOMEvent=0xbfffca28, aCurrentTarget=0x20ba97b0, aFlags=6, aEventStatus=0xbfffca2c) at /Users/roc/mozilla-checkin/content/events/src/nsEventListenerManager.cpp:1196
#41 0x0352a598 in nsEventTargetChainItem::HandleEvent (this=0x218e9d60, aVisitor=@0xbfffca20, aFlags=6, aMayHaveNewListenerManagers=1) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:236
#42 0x0352a7d8 in nsEventTargetChainItem::HandleEventTargetChain (this=0x218e9dc0, aVisitor=@0xbfffca20, aFlags=6, aCallback=0x0, aMayHaveNewListenerManagers=1) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:300
#43 0x0352b02e in nsEventDispatcher::Dispatch (aTarget=0x20ba97b0, aPresContext=0x0, aEvent=0xbfffcabc, aDOMEvent=0x0, aEventStatus=0xbfffcae4, aCallback=0x0) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:514
#44 0x036f4bf6 in nsGlobalWindow::PostHandleEvent (this=0xf66d700, aVisitor=@0xbfffccb0) at /Users/roc/mozilla-checkin/dom/src/base/nsGlobalWindow.cpp:2331
#45 0x035298a8 in nsEventTargetChainItem::PostHandleEvent (this=0x218e9c20, aVisitor=@0xbfffccb0) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:248
#46 0x0352a7f7 in nsEventTargetChainItem::HandleEventTargetChain (this=0x218e9d40, aVisitor=@0xbfffccb0, aFlags=518, aCallback=0x0, aMayHaveNewListenerManagers=0) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:303
#47 0x0352aa03 in nsEventTargetChainItem::HandleEventTargetChain (this=0x218e9d40, aVisitor=@0xbfffccb0, aFlags=6, aCallback=0x0, aMayHaveNewListenerManagers=1) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:354
#48 0x0352b02e in nsEventDispatcher::Dispatch (aTarget=0x87d8e60, aPresContext=0x211eae00, aEvent=0xbfffcd48, aDOMEvent=0x0, aEventStatus=0xbfffcd74, aCallback=0x0) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:514
#49 0x0319232f in DocumentViewerImpl::LoadComplete (this=0x9132160, aStatus=0) at /Users/roc/mozilla-checkin/layout/base/nsDocumentViewer.cpp:983
#50 0x0a7c5222 in nsDocShell::EndPageLoad (this=0xe11ff70, aProgress=0xe11ff84, aChannel=0xd3334a0, aStatus=0) at /Users/roc/mozilla-checkin/docshell/base/nsDocShell.cpp:5168
#51 0x0a7e5aa5 in nsWebShell::EndPageLoad (this=0xe11ff70, aProgress=0xe11ff84, channel=0xd3334a0, aStatus=0) at /Users/roc/mozilla-checkin/docshell/base/nsWebShell.cpp:1013
#52 0x0a7b4f7d in nsDocShell::OnStateChange (this=0xe11ff70, aProgress=0xe11ff84, aRequest=0xd3334a0, aStateFlags=131088, aStatus=0) at /Users/roc/mozilla-checkin/docshell/base/nsDocShell.cpp:5073
#53 0x0a7fc7ee in nsDocLoader::FireOnStateChange (this=0xe11ff70, aProgress=0xe11ff84, aRequest=0xd3334a0, aStateFlags=131088, aStatus=0) at /Users/roc/mozilla-checkin/uriloader/base/nsDocLoader.cpp:1235
#54 0x0a7fcb3d in nsDocLoader::doStopDocumentLoad (this=0xe11ff70, request=0xd3334a0, aStatus=0) at /Users/roc/mozilla-checkin/uriloader/base/nsDocLoader.cpp:858
#55 0x0a7fcd32 in nsDocLoader::DocLoaderIsEmpty (this=0xe11ff70) at /Users/roc/mozilla-checkin/uriloader/base/nsDocLoader.cpp:763
#56 0x0a7fd83d in nsDocLoader::OnStopRequest (this=0xe11ff70, aRequest=0xd37bbf0, aCtxt=0x0, aStatus=0) at /Users/roc/mozilla-checkin/uriloader/base/nsDocLoader.cpp:679
#57 0x0182a0c7 in nsLoadGroup::RemoveRequest (this=0x20baacb0, request=0xd37bbf0, ctxt=0x0, aStatus=0) at /Users/roc/mozilla-checkin/netwerk/base/src/nsLoadGroup.cpp:688
#58 0x0344d95b in nsDocument::DoUnblockOnload (this=0x211ed400) at /Users/roc/mozilla-checkin/content/base/src/nsDocument.cpp:7019
#59 0x03458d87 in nsDocument::UnblockOnload (this=0x211ed400, aFireSync=1) at /Users/roc/mozilla-checkin/content/base/src/nsDocument.cpp:6966
#60 0x0345476b in nsDocument::DispatchContentLoadedEvents (this=0x211ed400) at /Users/roc/mozilla-checkin/content/base/src/nsDocument.cpp:3911
#61 0x03464f02 in nsRunnableMethod<nsDocument>::Run (this=0x20c0c990) at nsThreadUtils.h:264
#62 0x00484294 in nsThread::ProcessNextEvent (this=0xa16610, mayWait=0, result=0xbfffd644) at /Users/roc/mozilla-checkin/xpcom/threads/nsThread.cpp:510
#63 0x0040e1ce in NS_ProcessPendingEvents_P (thread=0xa16610, timeout=20) at nsThreadUtils.cpp:180
#64 0x01c191e1 in nsBaseAppShell::NativeEventCallback (this=0xa42c50) at /Users/roc/mozilla-checkin/widget/src/xpwidgets/nsBaseAppShell.cpp:121
#65 0x01bd1792 in nsAppShell::ProcessGeckoEvents (aInfo=0xa42c50) at /Users/roc/mozilla-checkin/widget/src/cocoa/nsAppShell.mm:373
#66 0x921fc615 in CFRunLoopRunSpecific ()
#67 0x921fccf8 in CFRunLoopRunInMode ()
#68 0x9390c480 in RunCurrentEventLoopInMode ()
#69 0x9390c299 in ReceiveNextEventCommon ()
#70 0x9390c10d in BlockUntilNextEventMatchingListInMode ()
#71 0x94caf3ed in _DPSNextEvent ()
#72 0x94caeca0 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#73 0x94ca7cdb in -[NSApplication run] ()
#74 0x01bd0054 in nsAppShell::Run (this=0xa42c50) at /Users/roc/mozilla-checkin/widget/src/cocoa/nsAppShell.mm:692
#75 0x028b67be in nsAppStartup::Run (this=0xa5d420) at /Users/roc/mozilla-checkin/toolkit/components/startup/src/nsAppStartup.cpp:182
#76 0x000f5071 in XRE_main (argc=3, argv=0xbfffec94, aAppData=0xa0e190) at /Users/roc/mozilla-checkin/toolkit/xre/nsAppRunner.cpp:3263
#77 0x000026e3 in main (argc=3, argv=0xbfffec94) at /Users/roc/mozilla-checkin/browser/app/nsBrowserApp.cpp:156
0 $AD(c = -1, b = ^all,^u,Bugzilla, a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":733]
    e = 1
    this = [object Object]
1 $zD(a = -1) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":733]
    c = [object Object]
    b = ^all,^u,Bugzilla
    this = [object Object]
2 $xD() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":732]
    c = undefined
    b = undefined
    a = [object Object]
    this = [object Object]
3 $oD(c = "107975fd8f8bd106", b = cat@Bugzilla@search@cat, a = 2) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":730]
    e = [object Object]
    this = [object Object]
4 $$C(f = true, e = "11d657e62a717e41", c = "107975fd8f8bd106", b = cat@Bugzilla@search@cat, true) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":726]
    g = undefined
    this = [object Object]
5 $2C([object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":720]
    sa = undefined
    W = undefined
    L = undefined
    F = undefined
    w = undefined
    this = [object Object]
6 $0C(a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":718]
    this = [object Object]
7 $7q() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":493]
    a = [object Object]
    this = [object Object]
8 $_q(a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":491]
    this = [object Object]
9 $WC() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":717]
    c = [object Object]
    b = [object Object]
    a = undefined
    this = [object Object]
10 $VC() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":716]
    this = [object Object]
11 $8q() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":494]
    a = [object Object]
    this = [object Object]
12 $5q(a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":493]
    this = [object Object]
13 $xp() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":470]
    this = [object Object]
14 $wp() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":470]
    this = [object Object]
15 $_w() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":598]
    this = [object Object]
16 $jq() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":481]
    b = "?ui=2&ik=17e10128ca&view=cv&th=11d657e62a717e41&cw=526&rt=h&cat=Bugzilla&search=cat"
    a = undefined
    this = [object Object]
17 $cx() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":601]
    b = undefined
    a = [object Object]
    this = [object Object]
18 anonymous() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":18]
    this = [object Object]
19 $xx([object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":606]
    b = undefined
    a = true
    this = [object Object]
20 $Ib(a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":135]
    this = [object Object]
21 Nba(b = [object Object], a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":50]
    c = undefined
    this = [object Window @ 0x83f37c0 (native @ 0x83f23a0)]
22 te([object Object], "ready", false, [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":49]
    u = [object Object]
    o = 0
    l = 1
    j = [object Object]
    h = 7
    this = [object Window @ 0x83f37c0 (native @ 0x83f23a0)]
23 Oba([object Object], [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":51]
    w = [object Object]
    u = undefined
    o = undefined
    l = true
    j = false
    this = [object Window @ 0x83f37c0 (native @ 0x83f23a0)]
24 $ec(a = "ready") ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":147]
    this = [object Object]
25 $xw(a = "ready") ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":586]
    this = [object Object]
26 $Ew() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":591]
    a = [object HTMLIFrameElement @ 0x20b916e0 (native @ 0x20b912e0)]
    this = [object Object]
27 $Bw(a = [object HTMLDocument @ 0x87e7f90 (native @ 0x211ed400)]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":590]
    f = null
    c = [object HTMLBodyElement @ 0x9017e30 (native @ 0xe23e980)]
    b = undefined
    this = [object Object]
28 $Aw([object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":589]
    this = [object Object]
29 $Ib(a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":135]
    this = [object Object]
30 Nba(b = [object Object], a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":50]
    c = undefined
    this = [object Window @ 0x83f37c0 (native @ 0x83f23a0)]
31 Qba(497, [object Event @ 0x9016fe0 (native @ 0x9016fb0)]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":54]
    F = [object Object]
    w = undefined
    u = undefined
    o = undefined
    l = undefined
    this = [object HTMLIFrameElement @ 0x20bbc970 (native @ 0x20ba97b0)]
32 anonymous(497, [object Event @ 0x9016fe0 (native @ 0x9016fb0)]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":118]
    this = [object HTMLIFrameElement @ 0x20bbc970 (native @ 0x20ba97b0)]
33 anonymous(497, [object Event @ 0x9016fe0 (native @ 0x9016fb0)]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":118]
    f = undefined
    this = [object HTMLIFrameElement @ 0x20bbc970 (native @ 0x20ba97b0)]
34 a(b = [object Event @ 0x9016fe0 (native @ 0x9016fb0)]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ":135]
    this = [object HTMLIFrameElement @ 0x20bbc970 (native @ 0x20ba97b0)]
$1 = void
(gdb) up
#1  0x002f65f4 in TraceRecorder::determineSlotType (this=0x1030f420, vp=0xddc0f6c) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:1767
1767	    JS_ASSERT((m != JSVAL_INT) || isInt32(*vp));
(gdb) p m
$2 = 1 '\001'
(gdb) p *vp
$3 = 261067426
OK, so *vp is a JSVAL_DOUBLE and m is JSVAL_INT.

roc says that *(jsdouble*)(*vp & ~7) is nan(0xfffffffffffff)
(gdb) p *(jsdouble*)(*vp & ~7)
$4 = nan(0xfffffffffffff)
Keywords: assertion, dogfood
(gdb) p *i
$5 = {
  {
    u = {
      code = nanojit::LIR_i2f, 
      oprnd_3 = 0, 
      oprnd_1 = 0, 
      oprnd_2 = 0
    }, 
    c = {
      code = nanojit::LIR_i2f, 
      resv = 0, 
      imm8a = 0, 
      imm8b = 0
    }, 
    i = {
      code = nanojit::LIR_i2f, 
      resv = 0, 
      imm16 = 0
    }, 
    t = {
      code = nanojit::LIR_i2f, 
      imm24 = 0
    }, 
    g = {
      code = nanojit::LIR_i2f, 
      resv = 0, 
      unused = 0
    }, 
    sti = {
      code = nanojit::LIR_i2f, 
      disp = 0, 
      oprnd_1 = 0, 
      oprnd_2 = 0
    }
  }
}
(gdb) p *(i-1)
$6 = {
  {
    u = {
      code = nanojit::LIR_ld, 
      oprnd_3 = 0, 
      oprnd_1 = 71, 
      oprnd_2 = 0
    }, 
    c = {
      code = nanojit::LIR_ld, 
      resv = 0, 
      imm8a = 71, 
      imm8b = 0
    }, 
    i = {
      code = nanojit::LIR_ld, 
      resv = 0, 
      imm16 = 71
    }, 
    t = {
      code = nanojit::LIR_ld, 
      imm24 = 18176
    }, 
    g = {
      code = nanojit::LIR_ld, 
      resv = 0, 
      unused = 71
    }, 
    sti = {
      code = nanojit::LIR_ld, 
      disp = 0, 
      oprnd_1 = 71, 
      oprnd_2 = 0
    }
  }
}
recording starting from https://mail.google.com/mail/?ui=2&view=js&name=js&ver=tIUS00Y3De8.LG&am=X_E4tcT3ECGphf3gOe7HmQ:733@8
globalObj=0x7fbc780, shape=69345
import vp=0x8b04134 name=$global0 type=string flags=0
import vp=0x8b04bcc name=$global1 type=string flags=0
import vp=0x8b04bb0 name=$global2 type=object flags=0
import vp=0x8b040f8 name=$global3 type=object flags=0
import vp=0x8b04150 name=$global4 type=string flags=0
import vp=0x8b0423c name=$global5 type=string flags=0
import vp=0x8b04290 name=$global6 type=string flags=0
import vp=0x8b04344 name=$global7 type=string flags=0
import vp=0x8b04e4c name=$global8 type=object flags=0
import vp=0x8b04328 name=$global9 type=string flags=0
import vp=0x8b04248 name=$global10 type=string flags=0
import vp=0x8b07040 name=$global11 type=object flags=0
import vp=0x8b04108 name=$global12 type=object flags=0
import vp=0x8b062a4 name=$global13 type=object flags=0
import vp=0x8b04118 name=$global14 type=string flags=0
import vp=0x8b047bc name=$global15 type=object flags=0
import vp=0x8b0757c name=$global16 type=string flags=0
import vp=0x8b04cac name=$global17 type=object flags=0
import vp=0x8b04208 name=$global18 type=string flags=0
import vp=0x8b047fc name=$global19 type=object flags=0
import vp=0x8b040e8 name=$global20 type=object flags=0
import vp=0x8b04228 name=$global21 type=string flags=0
import vp=0x8b047a4 name=$global22 type=object flags=0
import vp=0x8b04b78 name=$global23 type=string flags=0
import vp=0x8b043e4 name=$global24 type=string flags=0
import vp=0x8b04780 name=$global25 type=object flags=0
import vp=0x236d12dc name=$callee0 type=object flags=0
import vp=0x236d12e0 name=$this0 type=object flags=0
import vp=0x236d12e4 name=$$AD.a type=object flags=0
import vp=0x236d12e8 name=$$AD.b type=object flags=0
import vp=0x236d12ec name=$$AD.c type=int flags=0
import vp=0x236d1360 name=$$AD.e type=int flags=0
    start
    state = param 0 ecx
    sp = ld state[0]
    rp = ld state[4]
    cx = ld state[12]
    gp = ld state[8]
    eos = ld state[16]
    eor = ld state[20]
    $global0 = ld gp[648]
    $global1 = ld gp[6072]
    $global2 = ld gp[6016]
    $global3 = ld gp[528]
    $global4 = ld gp[704]
    $global5 = ld gp[1176]
    $global6 = ld gp[1344]
    $global7 = ld gp[1704]
    $global8 = ld gp[7352]
    $global9 = ld gp[1648]
    $global10 = ld gp[1200]
    $global11 = ld gp[#0x60a0]
    $global12 = ld gp[560]
    $global13 = ld gp[#0x4568]
    $global14 = ld gp[592]
    $global15 = ld gp[3992]
    $global16 = ld gp[#0x6b18]
    $global17 = ld gp[6520]
    $global18 = ld gp[1072]
    $global19 = ld gp[4120]
    $global20 = ld gp[496]
    $global21 = ld gp[1136]
    $global22 = ld gp[3944]
    $global23 = ld gp[5904]
    $global24 = ld gp[2024]
    $global25 = ld gp[3872]
    $callee0 = ld sp[-48]
    $this0 = ld sp[-40]
    $$AD.a = ld sp[-32]
    $$AD.b = ld sp[-24]
    ld1 = ld sp[-16]
    $$AD.c = i2f ld1
    ld2 = ld sp[-8]
    $$AD.e = i2f ld2
    sti sp[0] = $$AD.a
    sti sp[8] = $$AD.b
    sti sp[16] = ld2
    ld3 = ld $$AD.b[4]
    and1 = and ld3, -4
    guard(class is Array) = eq and1, clasp
    xf1: xf guard(class is Array) -> 0x22b8a8cd sp+24 rp+0

    ld4 = ld $$AD.b[28]
    ld5 = ld $$AD.b[16]
    ult1 = ult ld2, ld5
    xf2: xf ult1 -> 0x22b8a8cd sp+24 rp+0

    eq1 = eq ld4, 0
    xt1: xt eq1 -> 0x22b8a8cd sp+24 rp+0

    ld6 = ld ld4[-4]
    ult2 = ult ld2, ld6
    xf3: xf ult2 -> 0x22b8a8cd sp+24 rp+0

    lsh1 = lsh ld2, 2
    add1 = add ld4, lsh1
    ld7 = ld add1[0]
    and2 = and ld7, JSVAL_TAGMASK
    eq2 = eq and2, 4
    xf4: xf eq2 -> 0x22b8a8cd sp+24 rp+0

    and3 = and ld7, ~JSVAL_TAGMASK
    sti sp[8] = and3
    sti sp[16] = $$AD.a
    sti sp[24] = and3
    ld8 = ld $$AD.a[0]
    ops = ld ld8[4]
    ld9 = ld ops[16]
    guard(native-map) = eq ld9, OP(&js_ObjectOps)
    xf5: xf guard(native-map) -> 0x22b8a8cf sp+32 rp+0

    shape = ld ld8[32]
    guard(shape) = eq shape, #0x1325c
    xf6: xf guard(shape) -> 0x22b8a8cf sp+32 rp+0

    js_Any_getprop1 = js_Any_getprop ( cx $$AD.a and3 )
    eq3 = eq js_Any_getprop1, JSVAL_ERROR_COOKIE
    xt2: xt eq3 -> 0x22b8a8cf sp+32 rp+0

    and4 = and js_Any_getprop1, JSVAL_TAGMASK
    eq4 = eq and4, 6
    xf7: xf eq4 -> 0x22b8a8cf sp+32 rp+0

    ush1 = ush js_Any_getprop1, 3
    sti sp[16] = ush1
    sti sp[24] = ld1
    ov1 = ov ld1
    xt3: xt ov1 -> 0x22b8a8d3 sp+32 rp+0

    sti sp[16] = ld1
    js_BoxInt32_1 = js_BoxInt32 ( cx ld1 )

Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:1767
This is m-c, not tm tip. Not confirmed with tm tip yet.
Keywords: assertion, dogfood
Severity: normal → critical
Flags: blocking1.9.1?
Priority: -- → P1
Assignee: general → gal
I see the same, or at least a similar, crash with t-m nightly build:
ftp://ftp.mozilla.org/pub/firefox/nightly/2008-11-03-02-tracemonkey
Keywords: assertion, dogfood
I got this crash with tip:

#0  0x002db486 in TraceRecorder::record_JSOP_GETLOCAL (this=0x1fb409d0) at /Users/gal/workspace/tracemonkey-repository/js/src/jstracer.cpp:6411
#1  0x002384b6 in js_Interpret (cx=0xe46200) at jsopcode.tbl:233
#2  0x002487d2 in js_Invoke (cx=0xe46200, argc=1, vp=0xec8094, flags=0) at jsinterp.cpp:1324
#3  0x00202562 in js_fun_call (cx=0xe46200, argc=1, vp=0xec807c) at /Users/gal/workspace/tracemonkey-repository/js/src/jsfun.cpp:1641
#4  0x002243b9 in js_Interpret (cx=0xe46200) at /Users/gal/workspace/tracemonkey-repository/js/src/jsinterp.cpp:5130
#5  0x002487d2 in js_Invoke (cx=0xe46200, argc=0, vp=0xec7c68, flags=0) at jsinterp.cpp:1324
#6  0x00202910 in js_fun_apply (cx=0xe46200, argc=0, vp=0xec7c50) at /Users/gal/workspace/tracemonkey-repository/js/src/jsfun.cpp:1730
#7  0x002243b9 in js_Interpret (cx=0xe46200) at /Users/gal/workspace/tracemonkey-repository/js/src/jsinterp.cpp:5130
#8  0x002487d2 in js_Invoke (cx=0xe46200, argc=0, vp=0xec798c, flags=0) at jsinterp.cpp:1324
#9  0x00202910 in js_fun_apply (cx=0xe46200, argc=0, vp=0xec7974) at /Users/gal/workspace/tracemonkey-repository/js/src/jsfun.cpp:1730
#10 0x002243b9 in js_Interpret (cx=0xe46200) at /Users/gal/workspace/tracemonkey-repository/js/src/jsinterp.cpp:5130
#11 0x002487d2 in js_Invoke (cx=0xe46200, argc=1, vp=0xec76ac, flags=0) at jsinterp.cpp:1324
#12 0x00202910 in js_fun_apply (cx=0xe46200, argc=1, vp=0xec7694) at /Users/gal/workspace/tracemonkey-repository/js/src/jsfun.cpp:1730
#13 0x002243b9 in js_Interpret (cx=0xe46200) at /Users/gal/workspace/tracemonkey-repository/js/src/jsinterp.cpp:5130
#14 0x002472da in js_Execute (cx=0xe46200, chain=0x1c594760, script=0x1eda3a80, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1550
#15 0x001c3844 in JS_EvaluateUCScriptForPrincipals (cx=0xe46200, obj=0x1c594760, principals=0x1ec0db94, chars=0x1f097608, length=229, filename=0x1dd0a688 "http://mail.google.com/mail/?ui=2&view=js&name=js&ver=A5pcKYmUmLY&am=X_E4tcT3ECGpBf3gOdJHWQ", lineno=1124, rval=0x0) at /Users/gal/workspace/tracemonkey-repository/js/src/jsapi.cpp:5187
#16 0x130ac4e9 in nsJSContext::EvaluateString (this=0x1ddb8ee0, aScript=@0xbfffd3d4, aScopeObject=0x1c594760, aPrincipal=0x1ec0db90, aURL=0x1dd0a688 "http://mail.google.com/mail/?ui=2&view=js&name=js&ver=A5pcKYmUmLY&am=X_E4tcT3ECGpBf3gOdJHWQ", aLineNo=1124, aVersion=0, aRetValue=0x0, aIsUndefined=0xbfffd358) at /Users/gal/workspace/tracemonkey-repository/dom/src/base/nsJSEnvironment.cpp:1586
#17 0x12e8dea2 in nsScriptLoader::EvaluateScript (this=0x1ec0da60, aRequest=0x1ed36b40, aScript=@0xbfffd3d4) at /Users/gal/workspace/tracemonkey-repository/content/base/src/nsScriptLoader.cpp:646
#18 0x12e8e10c in nsScriptLoader::ProcessRequest (this=0x1ec0da60, aRequest=0x1ed36b40) at /Users/gal/workspace/tracemonkey-repository/content/base/src/nsScriptLoader.cpp:556
#19 0x12e8f3ea in nsScriptLoader::ProcessScriptElement (this=0x1ec0da60, aElement=0x1ed36ac0) at /Users/gal/workspace/tracemonkey-repository/content/base/src/nsScriptLoader.cpp:510
#20 0x12e8abea in nsScriptElement::MaybeProcessScript (this=0x1ed36ac0) at /Users/gal/workspace/tracemonkey-repository/content/base/src/nsScriptElement.cpp:188
#21 0x12f5d649 in nsHTMLScriptElement::MaybeProcessScript (this=0x1ed36aa0) at /Users/gal/workspace/tracemonkey-repository/content/html/content/src/nsHTMLScriptElement.cpp:547
#22 0x12f5cbe5 in nsHTMLScriptElement::DoneAddingChildren (this=0x1ed36aa0, aHaveNotified=1) at /Users/gal/workspace/tracemonkey-repository/content/html/content/src/nsHTMLScriptElement.cpp:484
#23 0x12f8b01d in HTMLContentSink::ProcessSCRIPTEndTag (this=0xeaa800, content=0x1ed36aa0, aMalformed=0) at /Users/gal/workspace/tracemonkey-repository/content/html/document/src/nsHTMLContentSink.cpp:3134
#24 0x12f8c83b in SinkContext::CloseContainer (this=0x1ec0e080, aTag=eHTMLTag_script, aMalformed=0) at /Users/gal/workspace/tracemonkey-repository/content/html/document/src/nsHTMLContentSink.cpp:1021
#25 0x12f8ccf9 in HTMLContentSink::CloseContainer (this=0xeaa800, aTag=eHTMLTag_script) at /Users/gal/workspace/tracemonkey-repository/content/html/document/src/nsHTMLContentSink.cpp:2380
#26 0x1b29b080 in CNavDTD::CloseContainer (this=0x1ec12ea0, aTag=eHTMLTag_script, aMalformed=0) at /Users/gal/workspace/tracemonkey-repository/parser/htmlparser/src/CNavDTD.cpp:2802
#27 0x1b29be60 in CNavDTD::HandleEndToken (this=0x1ec12ea0, aToken=0xe9f330) at /Users/gal/workspace/tracemonkey-repository/parser/htmlparser/src/CNavDTD.cpp:1681
#28 0x1b29eaf0 in CNavDTD::HandleToken (this=0x1ec12ea0, aToken=0xe9f330, aParser=0x1ec0de70) at /Users/gal/workspace/tracemonkey-repository/parser/htmlparser/src/CNavDTD.cpp:762
#29 0x1b2983f1 in CNavDTD::BuildModel (this=0x1ec12ea0, aParser=0x1ec0de70, aTokenizer=0x1ec12d30, anObserver=0x0, aSink=0xeaa890) at /Users/gal/workspace/tracemonkey-repository/parser/htmlparser/src/CNavDTD.cpp:334
#30 0x1b2ab047 in nsParser::BuildModel (this=0x1ec0de70) at /Users/gal/workspace/tracemonkey-repository/parser/htmlparser/src/nsParser.cpp:2351
#31 0x1b2aee4a in nsParser::ResumeParse (this=0x1ec0de70, allowIteration=1, aIsFinalChunk=0, aCanInterrupt=1) at /Users/gal/workspace/tracemonkey-repository/parser/htmlparser/src/nsParser.cpp:2220
#32 0x1b2ae6a2 in nsParser::OnDataAvailable (this=0x1ec0de70, request=0x1ddba520, aContext=0x0, pIStream=0x1ec12c70, sourceOffset=154826, aLength=80521) at /Users/gal/workspace/tracemonkey-repository/parser/htmlparser/src/nsParser.cpp:2870
#33 0x19e424c5 in nsDocumentOpenInfo::OnDataAvailable (this=0x1ddba900, request=0x1ddba520, aCtxt=0x0, inStr=0x1ec12c70, sourceOffset=154826, count=80521) at /Users/gal/workspace/tracemonkey-repository/uriloader/base/nsURILoader.cpp:306
#34 0x1140d44b in nsHTTPCompressConv::do_OnDataAvailable (this=0x1ec12250, request=0x1ddba520, context=0x0, offset=154826, buffer=0x1e397000 "ga(false)};CM[r].Fhc=function $61(a){var b=a[C];if(b.kf()){this.P_=this.G3b!=b.Ph();this.lvb()}else this.Uga(false)};CM[r].lvb=function $71(){Hl[Lf](this.J1c,this.Ghc.Sa(this))};CM[r].Ghc=function $81"..., count=80521) at /Users/gal/workspace/tracemonkey-repository/netwerk/streamconv/converters/nsHTTPCompressConv.cpp:375
#35 0x1140db25 in nsHTTPCompressConv::OnDataAvailable (this=0x1ec12250, request=0x1ddba520, aContext=0x0, iStr=0x1ec12540, aSourceOffset=154826, aCount=28156) at /Users/gal/workspace/tracemonkey-repository/netwerk/streamconv/converters/nsHTTPCompressConv.cpp:306
#36 0x113e9522 in nsStreamListenerTee::OnDataAvailable (this=0x1ec12300, request=0x1ddba520, context=0x0, input=0x1ddbae3c, offset=154826, count=28156) at /Users/gal/workspace/tracemonkey-repository/netwerk/base/src/nsStreamListenerTee.cpp:97
#37 0x1148a34a in nsHttpChannel::OnDataAvailable (this=0x1ddba4f0, request=0x1ddbaf50, ctxt=0x0, input=0x1ddbae3c, offset=154826, count=28156) at /Users/gal/workspace/tracemonkey-repository/netwerk/protocol/http/src/nsHttpChannel.cpp:4858
#38 0x113b60e3 in nsInputStreamPump::OnStateTransfer (this=0x1ddbaf50) at /Users/gal/workspace/tracemonkey-repository/netwerk/base/src/nsInputStreamPump.cpp:508
#39 0x113b6634 in nsInputStreamPump::OnInputStreamReady (this=0x1ddbaf50, stream=0x1ddbae3c) at /Users/gal/workspace/tracemonkey-repository/netwerk/base/src/nsInputStreamPump.cpp:398
#40 0x0042f0ae in nsInputStreamReadyEvent::Run (this=0x1ed71a00) at /Users/gal/workspace/tracemonkey-repository/xpcom/io/nsStreamUtils.cpp:111
#41 0x004617b0 in nsThread::ProcessNextEvent (this=0x7149a0, mayWait=0, result=0xbfffe214) at /Users/gal/workspace/tracemonkey-repository/xpcom/threads/nsThread.cpp:510
#42 0x003eaf10 in NS_ProcessPendingEvents_P (thread=0x7149a0, timeout=20) at nsThreadUtils.cpp:180
#43 0x117b80a1 in nsBaseAppShell::NativeEventCallback (this=0x734370) at /Users/gal/workspace/tracemonkey-repository/widget/src/xpwidgets/nsBaseAppShell.cpp:121
#44 0x11770bf0 in nsAppShell::ProcessGeckoEvents (aInfo=0x734370) at /Users/gal/workspace/tracemonkey-repository/widget/src/cocoa/nsAppShell.mm:373
#45 0x9622965f in CFRunLoopRunSpecific ()
#46 0x96229cf8 in CFRunLoopRunInMode ()
#47 0x92c99480 in RunCurrentEventLoopInMode ()
#48 0x92c99299 in ReceiveNextEventCommon ()
#49 0x92c9910d in BlockUntilNextEventMatchingListInMode ()
#50 0x91ede3ed in _DPSNextEvent ()
#51 0x91eddca0 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#52 0x91ed6cdb in -[NSApplication run] ()
#53 0x1176f4b2 in nsAppShell::Run (this=0x734370) at /Users/gal/workspace/tracemonkey-repository/widget/src/cocoa/nsAppShell.mm:692
#54 0x1245875e in nsAppStartup::Run (this=0x74e100) at /Users/gal/workspace/tracemonkey-repository/toolkit/components/startup/src/nsAppStartup.cpp:182
#55 0x000e3ce3 in XRE_main (argc=1, argv=0xbffff860, aAppData=0x70e620) at /Users/gal/workspace/tracemonkey-repository/toolkit/xre/nsAppRunner.cpp:3263
#56 0x000027cb in main (argc=1, argv=0xbffff860) at /Users/gal/workspace/tracemonkey-repository/browser/app/nsBrowserApp.cpp:156
This fixes my bug. Leaving open until we have confirmed roc's bug is the same issue.
Looking at the mozilla-central code we don't see how this condition could trigger in mozilla-central without multi-trees (the bug is old, but the condition that triggers it is new).
That patch, hand-applied to my tree, doesn't seem to fix the bug. I still crash in the same place.
But I can't get the latest tracemonkey hourly to crash.
Flags: blocking1.9.1? → blocking1.9.1+
I can't get the assert either.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.