476760 - TM: Assertion failed: cx->bailExit on cnn.com

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andreas Gal :gal]

For application/x-shockwave-flash found plugin Flash Player.plugin
Assertion failure: cx->bailExit, at ../../../js/src/jstracer.cpp:4626

Comment 1

[Andreas Gal :gal]

Program received signal SIGTRAP, Trace/breakpoint trap.
JS_Assert (s=0x3e9676 "cx->bailExit", file=0x3e836d "../../../js/src/jstracer.cpp", ln=4626) at ../../../js/src/jsutil.cpp:63
63	    abort();
(gdb) bt
#0  JS_Assert (s=0x3e9676 "cx->bailExit", file=0x3e836d "../../../js/src/jstracer.cpp", ln=4626) at ../../../js/src/jsutil.cpp:63
#1  0x003689b2 in js_GetTopStackFrame (cx=0xf25400) at ../../../js/src/jstracer.cpp:4626
#2  0x002e1c5f in InferFlags (cx=0xf25400, defaultFlags=65535) at ../../../js/src/jsobj.cpp:2072
#3  0x002e3f5b in js_LookupPropertyWithFlags (cx=0xf25400, obj=0x16e02070, id=378542820, flags=65535, objp=0xbfff93ec, propp=0xbfff93e8) at ../../../js/src/jsobj.cpp:3592
#4  0x002e4568 in js_LookupProperty (cx=0xf25400, obj=0x16e02070, id=378542820, objp=0xbfff93ec, propp=0xbfff93e8) at ../../../js/src/jsobj.cpp:3522
#5  0x002e0bac in js_HasOwnProperty (cx=0xf25400, lookup=0x2e452e <js_LookupProperty>, obj=0x16e02070, id=378542820, vp=0xbfff9448) at ../../../js/src/jsobj.cpp:1629
#6  0x002e0eba in Object_p_hasOwnProperty (cx=0xf25400, obj=0x16e02070, str=0x16901ae0) at ../../../js/src/jsobj.cpp:1687
#7  0x1d9d56a6 in ?? ()
#8  0xbfffc6c8 in ?? ()
#9  0x0038e466 in js_MonitorLoopEdge (cx=0xf25400, inlineCallCount=@0xbfffcae8) at ../../../js/src/jstracer.cpp:4267
#10 0x002ab3b2 in js_Interpret (cx=0xf25400) at ../../../js/src/jsinterp.cpp:3108
#11 0x002d05aa in js_Execute (cx=0xf25400, chain=0x17204aa0, script=0x16986000, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1565
#12 0x0025dce1 in JS_EvaluateUCScriptForPrincipals (cx=0xf25400, obj=0x17204aa0, principals=0x1f40f8c4, chars=0x16f84008, length=152034, filename=0x1d8be248 "http://i.cdn.turner.com/cnn/.e/js/2.0/video/xmp/xmp_baseplayer.js", lineno=1, rval=0x0) at ../../../js/src/jsapi.cpp:5244
#13 0x130b46fb in nsJSContext::EvaluateString (this=0x1d87fbb0, aScript=@0x1d8be624, aScopeObject=0x17204aa0, aPrincipal=0x1f40f8c0, aURL=0x1d8be248 "http://i.cdn.turner.com/cnn/.e/js/2.0/video/xmp/xmp_baseplayer.js", aLineNo=1, aVersion=0, aRetValue=0x0, aIsUndefined=0xbfffd094) at ../../../../dom/src/base/nsJSEnvironment.cpp:1598
#14 0x12e9128a in nsScriptLoader::EvaluateScript (this=0x1f8a9df0, aRequest=0x1d8be610, aScript=@0x1d8be624) at ../../../../content/base/src/nsScriptLoader.cpp:671
#15 0x12e914f4 in nsScriptLoader::ProcessRequest (this=0x1f8a9df0, aRequest=0x1d8be610) at ../../../../content/base/src/nsScriptLoader.cpp:585
#16 0x12e92444 in nsScriptLoader::ProcessScriptElement (this=0x1f8a9df0, aElement=0x1d8bd2d4) at ../../../../content/base/src/nsScriptLoader.cpp:496
#17 0x12e8ddd0 in nsScriptElement::MaybeProcessScript (this=0x1d8bd2d4) at ../../../../content/base/src/nsScriptElement.cpp:193
#18 0x12f617fd in nsHTMLScriptElement::MaybeProcessScript (this=0x1d8bd2b0) at ../../../../../content/html/content/src/nsHTMLScriptElement.cpp:547
#19 0x12f60ab1 in nsHTMLScriptElement::DoneAddingChildren (this=0x1d8bd2b0, aHaveNotified=1) at ../../../../../content/html/content/src/nsHTMLScriptElement.cpp:484
#20 0x12f8fddd in HTMLContentSink::ProcessSCRIPTEndTag (this=0xcd5e00, content=0x1d8bd2b0, aMalformed=0) at ../../../../../content/html/document/src/nsHTMLContentSink.cpp:3134
#21 0x12f915fb in SinkContext::CloseContainer (this=0x1f53d580, aTag=eHTMLTag_script, aMalformed=0) at ../../../../../content/html/document/src/nsHTMLContentSink.cpp:1023
#22 0x12f91ab9 in HTMLContentSink::CloseContainer (this=0xcd5e00, aTag=eHTMLTag_script) at ../../../../../content/html/document/src/nsHTMLContentSink.cpp:2389
#23 0x1b3fa3d4 in CNavDTD::CloseContainer (this=0x1da07190, aTag=eHTMLTag_script, aMalformed=0) at ../../../../parser/htmlparser/src/CNavDTD.cpp:2798
#24 0x1b3fb1b4 in CNavDTD::HandleEndToken (this=0x1da07190, aToken=0x2104f600) at ../../../../parser/htmlparser/src/CNavDTD.cpp:1677
#25 0x1b3fe07c in CNavDTD::HandleToken (this=0x1da07190, aToken=0x2104f600, aParser=0x18fdf270) at ../../../../parser/htmlparser/src/CNavDTD.cpp:761
#26 0x1b3f7746 in CNavDTD::BuildModel (this=0x1da07190, aParser=0x18fdf270, aTokenizer=0x1da069f0, anObserver=0x0, aSink=0xcd5e90) at ../../../../parser/htmlparser/src/CNavDTD.cpp:333
#27 0x1b40a199 in nsParser::BuildModel (this=0x18fdf270) at ../../../../parser/htmlparser/src/nsParser.cpp:2381
#28 0x1b40e4ab in nsParser::ResumeParse (this=0x18fdf270, allowIteration=1, aIsFinalChunk=1, aCanInterrupt=1) at ../../../../parser/htmlparser/src/nsParser.cpp:2254
#29 0x1b40ee54 in nsParser::ContinueInterruptedParsing (this=0x18fdf270) at ../../../../parser/htmlparser/src/nsParser.cpp:1741
#30 0x1b4074f2 in nsParser::HandleParserContinueEvent (this=0x18fdf270, ev=0x1d8bb9b0) at ../../../../parser/htmlparser/src/nsParser.cpp:1809
#31 0x1b410bff in nsParserContinueEvent::Run (this=0x1d8bb9b0) at ../../../../parser/htmlparser/src/nsParser.cpp:161
#32 0x0051bf84 in nsThread::ProcessNextEvent (this=0x7150c0, mayWait=0, result=0xbfffdc44) at ../../../xpcom/threads/nsThread.cpp:510
#33 0x004a4b50 in NS_ProcessPendingEvents_P (thread=0x7150c0, timeout=20) at nsThreadUtils.cpp:180
#34 0x1187e7d7 in nsBaseAppShell::NativeEventCallback (this=0x7355b0) at ../../../../widget/src/xpwidgets/nsBaseAppShell.cpp:121
#35 0x11835414 in nsAppShell::ProcessGeckoEvents (aInfo=0x7355b0) at ../../../../widget/src/cocoa/nsAppShell.mm:374
#36 0x90df65f5 in CFRunLoopRunSpecific ()
#37 0x90df6cd8 in CFRunLoopRunInMode ()
#38 0x90fa32c0 in RunCurrentEventLoopInMode ()
#39 0x90fa3012 in ReceiveNextEventCommon ()
#40 0x90fa2f4d in BlockUntilNextEventMatchingListInMode ()
#41 0x9013cd7d in _DPSNextEvent ()
#42 0x9013c630 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#43 0x9013566b in -[NSApplication run] ()
#44 0x11833cd6 in nsAppShell::Run (this=0x7355b0) at ../../../../widget/src/cocoa/nsAppShell.mm:693
#45 0x1253450a in nsAppStartup::Run (this=0x74f110) at ../../../../../toolkit/components/startup/src/nsAppStartup.cpp:192
#46 0x000e6568 in XRE_main (argc=1, argv=0xbffff2a0, aAppData=0x70e630) at ../../../toolkit/xre/nsAppRunner.cpp:3210
#47 0x000027cb in main (argc=1, argv=0xbffff2a0) at ../../../browser/app/nsBrowserApp.cpp:156
(gdb) p cx.pcHint
No symbol "cx" in current context.
(gdb) up
#1  0x003689b2 in js_GetTopStackFrame (cx=0xf25400) at ../../../js/src/jstracer.cpp:4626
4626	        JS_ASSERT(cx->bailExit);
(gdb) p cx.pcHint
$1 = (jsbytecode *) 0x0
(gdb)

Comment 2

[Andreas Gal :gal]

Attachment: patch

Only STATUS_FAIL sets bailExit, and in InferFlags we need to read cx->fp so we must be able to bail out (pcHint isn't sufficient, InferFlags needs flags from the current frame). We might be able to optimize this further down the road though.

Comment 3

[Andreas Gal :gal]

Attachment: right patch this time

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 360418 [details] [diff] [review]
right patch this time

Stealing to expedite getting this into TM -- jorendorff, please cover me as needed. Thanks,

/be

Comment 5

[Andreas Gal :gal]

Pushed to TM. http://hg.mozilla.org/tracemonkey/rev/41cd0a7504f5

We don't seem to have test coverage for this. This was in the IE-or-FF detect path of the Flash Player on cnn.com.

Comment 6

[Jason Orendorff [:jorendorff]]

Comment on attachment 360418 [details] [diff] [review]
right patch this time

hasOwnProperty should specify the flags using JSAutoResolveFlags to avoid getting into InferFlags.  This will keep us on trace more.

(But because the property name isn't necessarily trace-constant, we can hit a resolve hook.  So BOOL_FAIL is still the right thing here.)

Comment 7

[Bob Clary [:bc] (inactive)]

I can't reproduce this with a tm build on mac from this morning. I'm scanning cnn at the moment looking for a similar crash but haven't seen on in ~80 pages. I'll try a build from just before Andreas' checkin.

Comment 8

[Andreas Gal :gal]

try http://hg.mozilla.org/tracemonkey/rev/2b3e64603943

That should trigger it. I landed this patch instead of backing out. Sorry for not noting that more clearly (I merely added this one as a blocker to the offending bug).

Comment 9

[Bob Clary [:bc] (inactive)]

I tried that one as the predecessor to yours and didn't get a failure on 141 pages from cnn.

Comment 10

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/41cd0a7504f5

Comment 11

[Bob Clary [:bc] (inactive)]

still can't reproduce.

Comment 12

[Jason Orendorff [:jorendorff]]

You need an object with JSCLASS_NEW_RESOLVE to reproduce this.  In the shell, the following triggers this assertion for me in rev 2b3e64603943.

  for (i = 0; i < 5; i++)
    this.hasOwnProperty("x");

and I think that would hit it in the browser too.

Comment 13

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/4b49067d5258

Comment 14

[Robert Sayre]

to be clear, this is FIXED, right?

Comment 15

[Jason Orendorff [:jorendorff]]

Yes.