469309 - TM: crash in Google Maps code: Assertion failure: js_ReconstructStackDepth(cx, cx->fp->script, FI_SCRIPT_PC(fi, cx->fp)) == uintN(fi.s.spdist - cx->fp->script->nfixed)

Status: RESOLVED DUPLICATE of bug 469262

(Core :: JavaScript Engine, defect)

Description

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Assertion failure: js_ReconstructStackDepth(cx, cx->fp->script, FI_SCRIPT_PC(fi, cx->fp)) == uintN(fi.s.spdist - cx->fp->script->nfixed), at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:2783

(gdb) where
#0  JS_Assert (s=0x37a0a8 "js_ReconstructStackDepth(cx, cx->fp->script, FI_SCRIPT_PC(fi, cx->fp)) == uintN(fi.s.spdist - cx->fp->script->nfixed)", file=0x379414 "/Users/roc/mozilla-checkin/js/src/jstracer.cpp", ln=2783) at /Users/roc/mozilla-checkin/js/src/jsutil.cpp:63
#1  0x003084f9 in js_SynthesizeFrame (cx=0x1761000, fi=@0xbfffb038) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:2781
#2  0x0030a69c in js_ExecuteTree (cx=0x1761000, f=0x27bf2db0, inlineCallCount=@0xbfffc4d0, innermostNestedGuardp=0xbfffb530) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:3641
#3  0x00321542 in js_MonitorLoopEdge (cx=0x1761000, inlineCallCount=@0xbfffc4d0) at /Users/roc/mozilla-checkin/js/src/jstracer.cpp:3784
#4  0x0023eff2 in js_Interpret (cx=0x1761000) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:3710
#5  0x00273df4 in js_Execute (cx=0x1761000, chain=0x71da2e0, script=0x27bf8410, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1561
#6  0x001eb6e7 in JS_EvaluateUCScriptForPrincipals (cx=0x1761000, obj=0x71da2e0, principals=0x102f84a4, chars=0x93ae008, length=200045, filename=0x22a8d6d8 "https://maps-api-ssl.google.com/intl/en_ALL/mapfiles/138f/maps2.api/main.js", lineno=1, rval=0x0) at /Users/roc/mozilla-checkin/js/src/jsapi.cpp:5192
#7  0x0373b95d in nsJSContext::EvaluateString (this=0xe692780, aScript=@0x255f8b14, aScopeObject=0x71da2e0, aPrincipal=0x102f84a0, aURL=0x22a8d6d8 "https://maps-api-ssl.google.com/intl/en_ALL/mapfiles/138f/maps2.api/main.js", aLineNo=1, aVersion=0, aRetValue=0x0, aIsUndefined=0xbfffd224) at /Users/roc/mozilla-checkin/dom/src/base/nsJSEnvironment.cpp:1588
#8  0x0352160a in nsScriptLoader::EvaluateScript (this=0x6f09bb0, aRequest=0x255f8b00, aScript=@0x255f8b14) at /Users/roc/mozilla-checkin/content/base/src/nsScriptLoader.cpp:665
#9  0x035219da in nsScriptLoader::ProcessRequest (this=0x6f09bb0, aRequest=0x255f8b00) at /Users/roc/mozilla-checkin/content/base/src/nsScriptLoader.cpp:579
#10 0x03521a66 in nsScriptLoader::ProcessPendingRequests (this=0x6f09bb0) at /Users/roc/mozilla-checkin/content/base/src/nsScriptLoader.cpp:718
#11 0x03521cf0 in nsScriptLoader::OnStreamComplete (this=0x6f09bb0, aLoader=0x22a47900, aContext=0x255f8b00, aStatus=0, aStringLen=200045, aString=0x7b2e008 "/* Copyright 2005-2008 Google. To use maps on your own site, visit http://code.google.com/apis/maps/. */ (function(){function aa(a,b){window[a]=b}\nfunction ba(a,b,c){a.prototype[b]=c}\nfunction ca(a,b,"...) at /Users/roc/mozilla-checkin/content/base/src/nsScriptLoader.cpp:896

I think it's trying to load my Google calendar via
https://www.google.com/calendar/render?tab=mc
(that's mDocument->mDocumentURI in frame #9).

(gdb) p ::DumpJSStack()
0 ee(c = [function], [function], [function]) ["https://maps-api-ssl.google.com/intl/en_ALL/mapfiles/138f/maps2.api/main.js":93]
    g = undefined
    f = 0
    e = 1
    d = undefined
1 anonymous(d = [object Object], c = "elevation", "elevation", [object Object]) ["https://maps-api-ssl.google.com/intl/en_ALL/mapfiles/138f/maps2.api/main.js":520]
    g = undefined
    f = [object Object]
    e = [object Object]
    this = [object Object]
2 Qg([object Object], [object Object], "elevation", [object Object]) ["https://maps-api-ssl.google.com/intl/en_ALL/mapfiles/138f/maps2.api/main.js":516]
    this = [object Object]
3 Zs() ["https://maps-api-ssl.google.com/intl/en_ALL/mapfiles/138f/maps2.api/main.js":1536]
    i = [object Object]
    h = [object Object]
    g = [object Object]
    f = 1
    e = [object Object]
4 Ys() ["https://maps-api-ssl.google.com/intl/en_ALL/mapfiles/138f/maps2.api/main.js":1535]
    a = 
    this = [object Window @ 0xe694670 (native @ 0xe693290)]
5 anonymous() ["https://maps-api-ssl.google.com/intl/en_ALL/mapfiles/138f/maps2.api/main.js":1610]
    gD = [function]
    fD = [object Object]
    eD = undefined
    dD = [object Object]
    cD = [object Object]
    this = [object Window @ 0xe694670 (native @ 0xe693290)]
6 <TOP LEVEL> ["https://maps-api-ssl.google.com/intl/en_ALL/mapfiles/138f/maps2.api/main.js":1]
    this = [object Window @ 0xe694670 (native @ 0xe693290)]

frame #1:
(gdb) p fi
$9 = (const FrameInfo &) @0xbfffb038: {
  callee = 0x766a2a0, 
  ip_adj = 38, 
  typemap = 0x2673a4a0 "", 
  {
    s = {
      spdist = 6, 
      argc = 0
    }, 
    word = 6
  }
}
(gdb) p js_ReconstructStackDepth(cx, cx->fp->script, cx->fp->script->code + 38)
$12 = 3
(gdb) p fi.s.spdist
$7 = 6
(gdb) p cx->fp->script->nfixed
$8 = 4

So the assertion fails because 3 != 2.

Comment 1

[Brendan Eich [:brendan]]

This is the JSOP_APPLY bug that Andreas was going to take. I don't know if it's a dup -- Andreas, David, can you guys sort this out? Thanks,

/be

Comment 2

[Jesse Ruderman]

Bug 469262 involves the same assertion.