465058 - Assertion failure: !fp->callee || fp->thisp == JSVAL_TO_OBJECT(fp->argv[-1]), at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:3496

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I was just browsing around and got this:

Assertion failure: !fp->callee || fp->thisp == JSVAL_TO_OBJECT(fp->argv[-1]), at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:3496

Relevant gdb stack trace:

#0  JS_Assert (s=0x36763c "!fp->callee || fp->thisp == JSVAL_TO_OBJECT(fp->argv[-1])", file=0x366544 "/Users/roc/mozilla-checkin/js/src/jstracer.cpp", ln=3496) at /Users/roc/mozilla-checkin/js/src/jsutil.cpp:63
#1  0x002ffd7c in js_ExecuteTree (cx=0x2bbbea00, f=0xf7510a0, inlineCallCount=@0xbfffac90, innermostNestedGuardp=0xbfffa0a0) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:3496
#2  0x00314d73 in js_MonitorLoopEdge (cx=0x2bbbea00, inlineCallCount=@0xbfffac90) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:3560
#3  0x0023b357 in js_Interpret (cx=0x2bbbea00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:3657
#4  0x0026b7c6 in js_Execute (cx=0x2bbbea00, chain=0x81f8620, script=0x3490bf40, down=0x2cd43838, flags=16, result=0xbfffb3bc) at jsinterp.cpp:1550
#5  0x00281e64 in obj_eval (cx=0x2bbbea00, obj=0x2a8aa00, argc=1, argv=0x2cd438b4, rval=0xbfffb3bc) at /Users/roc/mozilla-checkin/js/src/jsobj.cpp:1346
#6  0x0026cc2d in js_Invoke (cx=0x2bbbea00, argc=1, vp=0x2cd438ac, flags=2) at jsinterp.cpp:1306
#7  0x00248e35 in js_Interpret (cx=0x2bbbea00) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:5147
#8  0x0026ccbe in js_Invoke (cx=0x2bbbea00, argc=1, vp=0x2cd43824, flags=0) at jsinterp.cpp:1324
#9  0x0026cf74 in js_InternalInvoke (cx=0x2bbbea00, obj=0x7992920, fval=136238720, flags=0, argc=1, argv=0x2cd43820, rval=0xbfffc75c) at jsinterp.cpp:1381
#10 0x001e8587 in JS_CallFunctionValue (cx=0x2bbbea00, obj=0x7992920, fval=136238720, argc=1, argv=0x2cd43820, rval=0xbfffc75c) at /Users/roc/mozilla-checkin/js/src/jsapi.cpp:5242
#11 0x03795f76 in nsJSContext::CallEventHandler (this=0x36a5b160, aTarget=0x34eb1140, aScope=0x7992920, aHandler=0x81ed680, aargv=0x36babef0, arv=0xbfffc8d4) at /Users/roc/mozilla-checkin/dom/src/base/nsJSEnvironment.cpp:1979
#12 0x03806cce in nsJSEventListener::HandleEvent (this=0x7f2ff30, aEvent=0x33c68370) at /Users/roc/mozilla-checkin/dom/src/events/nsJSEventListener.cpp:247
#13 0x035b177b in nsEventListenerManager::HandleEventSubType (this=0x3450ff60, aListenerStruct=0x32d6dc68, aListener=0x7f2ff30, aDOMEvent=0x33c68370, aCurrentTarget=0x352d8880, aPhaseFlags=6) at /Users/roc/mozilla-checkin/content/events/src/nsEventListenerManager.cpp:1091
#14 0x035b330c in nsEventListenerManager::HandleEvent (this=0x3450ff60, aPresContext=0x2f250c00, aEvent=0xbfffcd68, aDOMEvent=0xbfffccd8, aCurrentTarget=0x352d8880, aFlags=6, aEventStatus=0xbfffccdc) at /Users/roc/mozilla-checkin/content/events/src/nsEventListenerManager.cpp:1196
#15 0x035e5910 in nsEventTargetChainItem::HandleEvent (this=0x27ac1220, aVisitor=@0xbfffccd0, aFlags=6, aMayHaveNewListenerManagers=1) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:236
#16 0x035e5b50 in nsEventTargetChainItem::HandleEventTargetChain (this=0x27ac1340, aVisitor=@0xbfffccd0, aFlags=6, aCallback=0x0, aMayHaveNewListenerManagers=1) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:300
#17 0x035e63a6 in nsEventDispatcher::Dispatch (aTarget=0x352d8840, aPresContext=0x2f250c00, aEvent=0xbfffcd68, aDOMEvent=0x0, aEventStatus=0xbfffcd94, aCallback=0x0) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:514
#18 0x0324d06d in DocumentViewerImpl::LoadComplete (this=0x3483a4b0, aStatus=0) at /Users/roc/mozilla-checkin/layout/base/nsDocumentViewer.cpp:983
#19 0x0a7d80dc in nsDocShell::EndPageLoad (this=0x32dadf90, aProgress=0x32dadfa4, aChannel=0x338a63e0, aStatus=0) at /Users/roc/mozilla-checkin/docshell/base/nsDocShell.cpp:5175

DumpJSStack:

0 trimAbstract("p21storyAbstractId20", 3, "p21storyHrefId20") ["http://www.myfoxatlanta.com/myfox/js/jon.js":635]
    bAdded = undefined
    pWords = ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
,,,,,,,,,,,,,,,,,,,,		KENNESAW,,Ga.,(MyFOX,ATLANTA),,Police,in,Kennesaw,said,Friday,they,were,look...
    sLastWord = ""
    sTmp = "                                        
   "
    nPos = 143
    this = [object Window @ 0x33f87000 (native @ 0x352d8870)]
1 updateP21Story2() ["http://www.myfoxatlanta.com/myfox/pages/News/Detail?contentId=7858948&version=2&locale=EN-US&layoutCode=TSTY&pageId=3.2.1":1006]
    this = [object Window @ 0x33f87000 (native @ 0x352d8870)]
2 updateAllPortlet() ["http://www.myfoxatlanta.com/myfox/js/jon.js":701]
    i = 2
    this = [object Window @ 0x33f87000 (native @ 0x352d8870)]
3 updateAllPortlet() ["http://www.myfoxatlanta.com/myfox/js/jon.js":701]
    i = 2
    this = [object Window @ 0x33f87000 (native @ 0x352d8870)]
4 onload(event = [object Event @ 0x2938b1f0 (native @ 0x33c68370)]) ["http://www.myfoxatlanta.com/myfox/pages/News/Detail?contentId=7858948&version=2&locale=EN-US&layoutCode=TSTY&pageId=3.2.1":1]
    this = [object Window @ 0x33f87000 (native @ 0x352d8870)]

Some possibly relevant data: from frame #1:
(gdb) p cx->fp
$18 = (JSStackFrame *) 0x2cd43948
(gdb) p cx->fp->down
$19 = (JSStackFrame *) 0x2cd438c4
(gdb) p cx->fp->down->down
$20 = (JSStackFrame *) 0xbfffb200
(gdb) p cx->fp->down->down->down
$21 = (JSStackFrame *) 0x2cd43838
(gdb) p cx->fp->down->down->down->down
$22 = (JSStackFrame *) 0xbfffc5a0
(gdb) p cx->fp->down->down->down->down->down
$23 = (JSStackFrame *) 0x0

(gdb) p fp
$25 = (JSStackFrame *) 0x2cd43838

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I seem to be able to reproduce this on trunk by visiting
http://www.myfoxatlanta.com/myfox/pages/News/Detail?contentId=7858948&version=2&locale=EN-US&layoutCode=TSTY&pageId=3.2.1

Comment 2

[Brendan Eich [:brendan]]

Dup of bug 457065 ?

/be

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Obsolete with the removal of tracejit.