476192 - TM: Assertion failure: JSVAL_TAG(v) == JSVAL_STRING during Topsitetest on http://www.sauto.cz/

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Carsten Book [:Tomcat]]

Attachment: gdb stack

Found during the automated TopSite Test on http://www.sauto.cz/ 

http://www.sauto.cz/ cause a Assertion failure: Assertion failure: JSVAL_TAG(v) == JSVAL_STRING, at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:1582

Comment 1

[Carsten Book [:Tomcat]]

Attachment: testcase

Comment 2

[Jesse Ruderman]

Attachment: shell testcase

Moved to the shell (just had to remove the <script> tags) and removed a few empty blocks and functions.  Now 28 lines.

Comment 3

[Jesse Ruderman]

Attachment: shell testcase, 25 lines

A little simpler: made some variables local, killed shadowing (!!) in loadAds.

Comment 4

[Jesse Ruderman]

Attachment: shell testcase, 9 lines

Can't reduce it much more than this.

Comment 5

[Jesse Ruderman]

Btw, this assertion also shows up in bug 475658.

Comment 6

[Andreas Gal :gal]

Confirmed.

Comment 7

[Carsten Book [:Tomcat]]

Note this is not fixed by Bug 475916 - i still see this with a TM tip build

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #4)
> Created an attachment (id=359861) [details]
> shell testcase, 9 lines
> 
> Can't reduce it much more than this.

This testcase seems to WFM in TM js shell (with and without -j), would like more confirmation before resolution.

Comment 9

[Robert Sayre]

(In reply to comment #7)
> Note this is not fixed by Bug 475916 - i still see this with a TM tip build

This WFM as well. Tomcat, can you still reproduce it?

Comment 10

[Robert Sayre]

Gary, can you use the auto bisecter to determine which changeset fixed this?

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #10)
> Gary, can you use the auto bisecter to determine which changeset fixed this?

autoBisect shows bug 476653 is likely to have fixed this.

changeset:   25401:0d0489b3e4b7
user:        David Anderson
date:        Tue Feb 24 22:52:09 2009 -0500
summary:     Fixed breakage of type stability guarantees between linked trees, and fixed using the wrong global typemap in LeaveTree (bug 476653, r=gal).

I've not yet manually verified this though.

Comment 12

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/tracemonkey/rev/488f2529b447
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-476192.js,v  <--  regress-476192.js
initial revision: 1.1

Comment 13

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #11)
> (In reply to comment #10)
> > Gary, can you use the auto bisecter to determine which changeset fixed this?
> 
> autoBisect shows bug 476653 is likely to have fixed this.
> 
> changeset:   25401:0d0489b3e4b7
> user:        David Anderson
> date:        Tue Feb 24 22:52:09 2009 -0500
> summary:     Fixed breakage of type stability guarantees between linked trees,
> and fixed using the wrong global typemap in LeaveTree (bug 476653, r=gal).
> 
> I've not yet manually verified this though.

I have manually verified that the fix in bug 476653 does indeed fix this issue as well.

Comment 14

[Robert Sayre]

 Bug 476653 is fixed1.9.1, so this is too.

Comment 15

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2

Comment 16

[Bob Clary [:bc] (inactive)]

fix summary to not include string 'Assertion fail'
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-476192.js,v  <--  regress-476192.js
new revision: 1.2; previous revision: 1.1