Last Comment Bug 476214 - TM: "Assertion failure: *(JSObject**)slot == NULL" on http://zaojiao.com/
: TM: "Assertion failure: *(JSObject**)slot == NULL" on http://zaojiao.com/
Status: RESOLVED WORKSFORME
: assertion
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: 1.9.1 Branch
: x86 Mac OS X
: P2 normal (vote)
: ---
Assigned To: general
:
:
Mentors:
http://zaojiao.com/
Depends on:
Blocks: sisyphus-tracking
  Show dependency treegraph
 
Reported: 2009-01-30 14:28 PST by Carsten Book [:Tomcat]
Modified: 2009-04-19 05:57 PDT (History)
6 users (show)
sayrer: blocking1.9.1+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Carsten Book [:Tomcat] 2009-01-30 14:28:21 PST
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090130 Firefox/3.2a1pre

Happened during the TopSite Testing on http://zaojiao.com/ - for some reasons i can reproduce this assertion on the http://zaojiao.com/ site, but not on a local copy

Assertion failure: *(JSObject**)slot == NULL, at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:1587

Program received signal SIGTRAP, Trace/breakpoint trap.
JS_Assert (s=0x3e76fc "*(JSObject**)slot == NULL", file=0x3e72ec "/work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp", ln=1587) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jsutil.cpp:63
63	    abort();
(gdb) bt
#0  JS_Assert (s=0x3e76fc "*(JSObject**)slot == NULL", file=0x3e72ec "/work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp", ln=1587) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jsutil.cpp:63
#1  0x00362051 in NativeToValue (cx=0x1307200, v=@0x17824d54, type=5 '\005', slot=0xbfff9c48) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:1587
#2  0x00362860 in FlushNativeGlobalFrame (cx=0x1307200, ngslots=1, gslots=0x850710, mp=0xbfff9570 "\005?<\001????\b???J?X\v", '?' <repeats 184 times>..., np=0xbfff9580) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:1633
#3  0x0036a9f3 in js_ExecuteTree (cx=0x1307200, f=0xfd1a170, inlineCallCount=@0xbfffc408, innermostNestedGuardp=0xbfffc028) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:4082
#4  0x0038f8ce in js_MonitorLoopEdge (cx=0x1307200, inlineCallCount=@0xbfffc408) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:4195
#5  0x002b5c45 in js_Interpret (cx=0x1307200) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jsinterp.cpp:3687
#6  0x002d2cfa in js_Execute (cx=0x1307200, chain=0x14bef480, script=0x17985200, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1562
#7  0x00262133 in JS_EvaluateUCScriptForPrincipals (cx=0x1307200, obj=0x14bef480, principals=0xf852ec4, chars=0xf62f008, length=4625, filename=0xf852298 "http://zaojiao.com/", lineno=2863, rval=0x0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jsapi.cpp:5242
#8  0x0ba4ebd5 in nsJSContext::EvaluateString (this=0x141edc00, aScript=@0xbfffca34, aScopeObject=0x14bef480, aPrincipal=0xf852ec0, aURL=0xf852298 "http://zaojiao.com/", aLineNo=2863, aVersion=0, aRetValue=0x0, aIsUndefined=0xbfffc9b4) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/dom/src/base/nsJSEnvironment.cpp:1598
#9  0x0b83424e in nsScriptLoader::EvaluateScript (this=0xf854b20, aRequest=0x1cd983b0, aScript=@0xbfffca34) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/base/src/nsScriptLoader.cpp:671
#10 0x0b83461e in nsScriptLoader::ProcessRequest (this=0xf854b20, aRequest=0x1cd983b0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/base/src/nsScriptLoader.cpp:585
#11 0x0b8358b8 in nsScriptLoader::ProcessScriptElement (this=0xf854b20, aElement=0x1cd909d4) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/base/src/nsScriptLoader.cpp:539
#12 0x0b831048 in nsScriptElement::MaybeProcessScript (this=0x1cd909d4) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/base/src/nsScriptElement.cpp:193
#13 0x0b90120d in nsHTMLScriptElement::MaybeProcessScript (this=0x1cd909b0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/html/content/src/nsHTMLScriptElement.cpp:547
#14 0x0b9002ed in nsHTMLScriptElement::DoneAddingChildren (this=0x1cd909b0, aHaveNotified=1) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/html/content/src/nsHTMLScriptElement.cpp:484
#15 0x0b92e7e9 in HTMLContentSink::ProcessSCRIPTEndTag (this=0x10d8600, content=0x1cd909b0, aMalformed=0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp:3134
#16 0x0b930007 in SinkContext::CloseContainer (this=0xf852e30, aTag=eHTMLTag_script, aMalformed=0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp:1023
#17 0x0b9304c5 in HTMLContentSink::CloseContainer (this=0x10d8600, aTag=eHTMLTag_script) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp:2389
#18 0x13c37db8 in CNavDTD::CloseContainer (this=0xf85c410, aTag=eHTMLTag_script, aMalformed=0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:2798
#19 0x13c38b98 in CNavDTD::HandleEndToken (this=0xf85c410, aToken=0x16fd460) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:1677
#20 0x13c3be04 in CNavDTD::HandleToken (this=0xf85c410, aToken=0x16fd460, aParser=0xf8554a0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:761
#21 0x13c3512a in CNavDTD::BuildModel (this=0xf85c410, aParser=0xf8554a0, aTokenizer=0xf85c4d0, anObserver=0x0, aSink=0x10d8690) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/CNavDTD.cpp:333
#22 0x13c47c59 in nsParser::BuildModel (this=0xf8554a0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:2381
#23 0x13c4bdd9 in nsParser::ResumeParse (this=0xf8554a0, allowIteration=1, aIsFinalChunk=1, aCanInterrupt=1) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:2254
#24 0x13c4c782 in nsParser::ContinueInterruptedParsing (this=0xf8554a0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:1741
#25 0x13c44fb2 in nsParser::HandleParserContinueEvent (this=0xf8554a0, ev=0x1cd96a80) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:1809
#26 0x13c4e17b in nsParserContinueEvent::Run (this=0x1cd96a80) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/parser/htmlparser/src/nsParser.cpp:161
#27 0x0051f4d8 in nsThread::ProcessNextEvent (this=0x815be0, mayWait=0, result=0xbfffd564) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/xpcom/threads/nsThread.cpp:510
#28 0x004a8ab2 in NS_ProcessPendingEvents_P (thread=0x815be0, timeout=20) at nsThreadUtils.cpp:180
#29 0x099330b9 in nsBaseAppShell::NativeEventCallback (this=0x8351e0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:121
#30 0x098ea31c in nsAppShell::ProcessGeckoEvents (aInfo=0x8351e0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/widget/src/cocoa/nsAppShell.mm:374
#31 0x954565f5 in CFRunLoopRunSpecific ()
#32 0x95456cd8 in CFRunLoopRunInMode ()
#33 0x9094f2c0 in RunCurrentEventLoopInMode ()
#34 0x9094f012 in ReceiveNextEventCommon ()
#35 0x9094ef4d in BlockUntilNextEventMatchingListInMode ()
#36 0x9619cd7d in _DPSNextEvent ()
#37 0x9619c630 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#38 0x9619566b in -[NSApplication run] ()
#39 0x098e82a0 in nsAppShell::Run (this=0x8351e0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/widget/src/cocoa/nsAppShell.mm:693
#40 0x0a5e853e in nsAppStartup::Run (this=0x84eb60) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:192
#41 0x000c21fe in XRE_main (argc=1, argv=0xbfffeaf8, aAppData=0x80ede0) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/toolkit/xre/nsAppRunner.cpp:3210
#42 0x000026e3 in main (argc=1, argv=0xbfffeaf8) at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/browser/app/nsBrowserApp.cpp:156
(gdb) quit
Comment 1 Brendan Eich [:brendan] 2009-01-30 14:40:26 PST
See also bug 466654 and bug 469254.

/be
Comment 2 Jesse Ruderman 2009-01-30 15:20:07 PST
WFM on TM branch and mozilla-central.
Comment 3 Carsten Book [:Tomcat] 2009-01-30 15:51:13 PST
(In reply to comment #2)
> WFM on TM branch and mozilla-central.

hmmm i can still reproduce this on TM hg id:
271e5fa192fd tip on the live site http://zaojiao.com/

Note: the site need to be loaded completed (including the flash elements)! which take from here 2 minutes or so.
Comment 4 Jesse Ruderman 2009-01-30 16:07:42 PST
I'm an idiot.  I can reproduce on TM branch once I turn the JIT back on.
Comment 5 Andreas Gal :gal 2009-02-26 15:49:24 PST
WFM with TM tip. Jesse, can you confirm?
Comment 6 Jesse Ruderman 2009-02-26 23:57:08 PST
WFM, TM branch.

Note You need to log in before you can comment on or make changes to this bug.