TM: crash (GMail): JS_Assert (s=0x368d8f "!JS_ON_TRACE(cx)", file=0x3724c8 "/Users/roc/mozilla-checkin/js/src/jsobj.cpp", ln=3765)

VERIFIED FIXED in mozilla1.9.1b3

Status

()

Core
JavaScript Engine
P1
blocker
VERIFIED FIXED
10 years ago
9 years ago

People

(Reporter: roc, Assigned: brendan)

Tracking

({dogfood, verified1.9.1})

unspecified
mozilla1.9.1b3
dogfood, verified1.9.1
Points:
---
Bug Flags:
blocking1.9.1 +
in-testsuite -
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(gdb) where
#0  JS_Assert (s=0x368d8f "!JS_ON_TRACE(cx)", file=0x3724c8 "/Users/roc/mozilla-checkin/js/src/jsobj.cpp", ln=3765) at /Users/roc/mozilla-checkin/js/src/jsutil.cpp:63
#1  0x0028bc16 in js_GetPropertyHelper (cx=0x2554a200, obj=0x7b457a0, id=210728212, vp=0xbffec2b0, entryp=0xbffec1dc) at /Users/roc/mozilla-checkin/js/src/jsobj.cpp:3765
#2  0x002482e3 in js_Interpret (cx=0x2554a200) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4403
#3  0x002752f8 in js_Invoke (cx=0x2554a200, argc=3, vp=0x2182ada8, flags=0) at jsinterp.cpp:1333
#4  0x0022a938 in js_fun_apply (cx=0x2554a200, argc=3, vp=0x2182ad90) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1732

0 $uE(b = undefined, a = search%40inbox,11e297359fb08cd6) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":748]
    e = 1
    c = [object Object]
    this = [object Object]
1 $vGa(c = undefined, b = "11e297359fb08cd6", a = search@inbox) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":596]
    this = [object Object]
2 $zDa() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":538]
    a = "25"
    this = nV
3 $nR(c = [object Object], b = [object Object], a = nV) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":887]
    this = fK
4 $cR(c = [object Object], b = [object Object], a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":883]
    f = nV
    e = "24"
    this = fK
5 $bR(c = [object Object], b = [object Object], [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":883]
    g = null
    f = null
    e = "23"
    this = fK
6 $$Q(c = [object Object], b = [object Object], a = "cv") ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":882]
    f = [object Object]
    e = [object Object]
    this = fK
7 anonymous() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":18]
    h = cv,[object Object],[object Object]
    this = [object Window @ 0x28dde9a0 (native @ 0x8840320)]
8 $rd() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":174]
    this = [object Object]
9 $qd(a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":174]
    e = 0
    c = [object Object]
    b = [object Object]
    this = [object Object]
10 $Gd(a = "cv") ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":176]
    this = [object Object]
11 zka(a = "try{function eW(a,b){return a.isCollapsed=b}function nOb(a,b){return a.insertNode=b}function oOb(a,b){var c=b;while(c=c[Ef])if(c==a)return-1;return 1}function pOb(a,b){var c=a[H];if(c==b)return-1;var e=b;while(e[H]!=c)e=e[H];return oOb(e,a)}function qOb(a){if(rOb in a)return a[fW];else{var b=Re(a)[Kj](N);b[K](a[Sw](true));return b[jj]}}
.......
// Copyright 2002-2008 Google Inc.
"
    this = [object Object]
14 anonymous([object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":18]
    h = [object Object],,function () {
    return a[Ob](g, arguments);
},[object Object]
    this = [object Object]
15 $Jb(a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":136]
    this = [object Object]
16 Uba(b = [object Object], a = [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":51]
    c = undefined
    this = [object Window @ 0x28dde9a0 (native @ 0x8840320)]
17 we([object Object], "success", false, [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":50]
    u = [object Object]
    o = 0
    l = 1
    j = [object Object]
    h = 127
    this = [object Window @ 0x28dde9a0 (native @ 0x8840320)]
18 Vba([object Object], [object Object]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":52]
    w = [object Object]
    u = undefined
    o = undefined
    l = true
    j = false
    this = [object Window @ 0x28dde9a0 (native @ 0x8840320)]
19 $fc(a = "success") ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":148]
    this = [object Object]
20 $wc(a = "success") ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":155]
    this = [object Object]
21 $Ec() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":158]
    this = [object Object]
22 $Dc() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":157]
    this = [object Object]
23 anonymous() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":119]
    this = [object Object]
24 anonymous() ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":119]
    f = undefined
    this = [object Object]
25 $Cc([object Event @ 0x2abe48a0 (native @ 0x2af2a7f0)]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":157]
    this = [object Object]
26 anonymous([object Event @ 0x2abe48a0 (native @ 0x2af2a7f0)]) ["https://mail.google.com/mail/?ui=2&view=js&name=js&ver=98bOGu6PJWY.LG&am=R-A8rcT3QCHJBXzqkOD89Q":18]
    this = [object XMLHttpRequest @ 0x2ac23550 (native @ 0x2ac23450)]
Flags: blocking1.9.1?
This seems to happen every single time I start GMail.

My build is changeset 055cb77c977c (the very tip of mozilla-central right now).
Severity: normal → blocker
Keywords: dogfood
Summary: TM crash (GMail): JS_Assert (s=0x368d8f "!JS_ON_TRACE(cx)", file=0x3724c8 "/Users/roc/mozilla-checkin/js/src/jsobj.cpp", ln=3765) → TM; crash (GMail): JS_Assert (s=0x368d8f "!JS_ON_TRACE(cx)", file=0x3724c8 "/Users/roc/mozilla-checkin/js/src/jsobj.cpp", ln=3765)
Summary: TM; crash (GMail): JS_Assert (s=0x368d8f "!JS_ON_TRACE(cx)", file=0x3724c8 "/Users/roc/mozilla-checkin/js/src/jsobj.cpp", ln=3765) → TM: crash (GMail): JS_Assert (s=0x368d8f "!JS_ON_TRACE(cx)", file=0x3724c8 "/Users/roc/mozilla-checkin/js/src/jsobj.cpp", ln=3765)
(Assignee)

Comment 2

10 years ago
Created attachment 352757 [details] [diff] [review]
possible fix, from patch for bug 465460

Jason, I'm out today -- could you shepherd this in if it's indeed the fix? Thanks,

/be
Attachment #352757 - Flags: review?(jorendorff)
(Assignee)

Updated

10 years ago
Attachment #352757 - Flags: review?(jorendorff) → review?(gal)
(Assignee)

Comment 3

10 years ago
Comment on attachment 352757 [details] [diff] [review]
possible fix, from patch for bug 465460

Whoops, Jason is out today too -- Andreas, hope you can test and get this in. Thanks,

/be

Updated

10 years ago
Flags: blocking1.9.1? → blocking1.9.1+

Comment 4

10 years ago
We are not able to reproduce. roc, could you confirm that the patch fixes the bug?
That seems to have fixed it.

Comment 6

10 years ago
Comment on attachment 352757 [details] [diff] [review]
possible fix, from patch for bug 465460

Confirmed to have fixed the bug.
Attachment #352757 - Flags: review?(gal) → review+
(Assignee)

Updated

10 years ago
Assignee: general → brendan
(Assignee)

Updated

10 years ago
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b3
(Assignee)

Comment 7

10 years ago
Fixed in tm and m-c:

http://hg.mozilla.org/tracemonkey/rev/3c3921f30981
http://hg.mozilla.org/mozilla-central/rev/40b2ff0a529b

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Flags: in-testsuite-
Flags: in-litmus-

Comment 9

10 years ago
(In reply to comment #5)
> That seems to have fixed it.

Robert, is this fixed?  i dont have gdb, can you verify its not doing this anymore on trunk and branch?  

Thanks, Tony
Definitely fixed on trunk. Not sure about branch, I don't have a branch build handy

Comment 11

10 years ago
marking verified on trunk per comment 10.  Revisit when we can track down a branch build
Status: RESOLVED → VERIFIED
verified FIXED on Shiretoko: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4pre) Gecko/20090422 Shiretoko/3.5b4pre ID:20090422042031
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.