478481 - TM: "Assertion failure: t == JSVAL_BOXED || isNumber(*p) == (t == JSVAL_DOUBLE)" on oil import map

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

http://move.rmi.org/files/oilmap/RMI_Oil_Imports_Final_large.html triggers:

Assertion failure: t == JSVAL_BOXED || isNumber(*p) == (t == JSVAL_DOUBLE), at /Users/jruderman/central/js/src/jstracer.cpp:1719

(mozilla-central, Mac, debug)

Comment 1

[Andreas Gal :gal]

Scary. Could you capture and attach the page? We don't want to lose the test case.

Comment 2

[Andreas Gal :gal]

This mighe be related (and be fixed by) the following bug which I am reviewing as we speak:

https://bugzilla.mozilla.org/show_bug.cgi?id=476653

Assertion failure: t == JSVAL_BOXED || isNumber(*p) == (t == JSVAL_DOUBLE), at ../../../js/src/jstracer.cpp:1719

Program received signal SIGTRAP, Trace/breakpoint trap.
JS_Assert (s=0x3f6934 "t == JSVAL_BOXED || isNumber(*p) == (t == JSVAL_DOUBLE)", file=0x3f62cd "../../../js/src/jstracer.cpp", ln=1719) at ../../../js/src/jsutil.cpp:63
63	    abort();
(gdb) bt
#0  JS_Assert (s=0x3f6934 "t == JSVAL_BOXED || isNumber(*p) == (t == JSVAL_DOUBLE)", file=0x3f62cd "../../../js/src/jstracer.cpp", ln=1719) at ../../../js/src/jsutil.cpp:63
#1  0x0036ea28 in TraceRecorder::import (this=0x19e29c50, base=0xbfcae0, offset=3328, p=0x18901a70, t=@0xbfffbd60, prefix=0x3f33ec "global", index=0, fp=0x0) at ../../../js/src/jstracer.cpp:1719
#2  0x0036f138 in TraceRecorder::import (this=0x19e29c50, treeInfo=0x18306c64, sp=0xbfcac8, stackSlots=24, ngslots=1, callDepth=0, typeMap=0x1830b430 "") at ../../../js/src/jstracer.cpp:1797
#3  0x0038ae10 in TraceRecorder::TraceRecorder (this=0x19e29c50, cx=0x21061800, _anchor=0x1830b400, _fragment=0x19e262a0, ti=0x18306c64, stackSlots=24, ngslots=0, typeMap=0x1830b430 "", innermostNestedGuard=0x0, outerToBlacklist=0x0) at ../../../js/src/jstracer.cpp:1253
#4  0x0038b052 in js_StartRecorder (cx=0x21061800, anchor=0x1830b400, f=0x19e262a0, ti=0x18306c64, stackSlots=24, ngslots=0, typeMap=0x1830b430 "", expectedInnerExit=0x0, outer=0x0) at ../../../js/src/jstracer.cpp:3047
#5  0x0038b300 in js_AttemptToExtendTree (cx=0x21061800, anchor=0x1830b400, exitedFrom=0x0, outer=0x0) at ../../../js/src/jstracer.cpp:3511
#6  0x0039c278 in js_MonitorLoopEdge (cx=0x21061800, inlineCallCount=@0xbfffc368) at ../../../js/src/jstracer.cpp:4281
#7  0x002bced4 in js_Interpret (cx=0x21061800) at ../../../js/src/jsinterp.cpp:3713
#8  0x002dd290 in js_Invoke (cx=0x21061800, argc=0, vp=0x18c6bf3c, flags=0) at jsinterp.cpp:1335
#9  0x002a7dc3 in js_fun_apply (cx=0x21061800, argc=0, vp=0x18c6bf04) at ../../../js/src/jsfun.cpp:1737
#10 0x002ca673 in js_Interpret (cx=0x21061800) at ../../../js/src/jsinterp.cpp:5007
#11 0x002dd290 in js_Invoke (cx=0x21061800, argc=1, vp=0x18c6bc20, flags=0) at jsinterp.cpp:1335
#12 0x1184abd1 in nsXPCWrappedJSClass::CallMethod (this=0x1bdcbd10, wrapper=0x19aa32c0, methodIndex=3, info=0x13e50b8, nativeParams=0xbfffd394) at ../../../../../js/src/xpconnect/src/xpcwrappedjsclass.cpp:1606
#13 0x11841e17 in nsXPCWrappedJS::CallMethod (this=0x19aa32c0, methodIndex=3, info=0x13e50b8, params=0xbfffd394) at ../../../../../js/src/xpconnect/src/xpcwrappedjs.cpp:561
#14 0x00549388 in PrepareAndDispatch (self=0x19aa32b0, methodIndex=3, args=0xbfffd4b4) at ../../../../../../../xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
#15 0x005493e7 in nsXPTCStubBase::Stub3 (this=0x19aa32b0) at xptcstubsdef.inc:1
#16 0x135918d9 in nsDOMEventListenerWrapper::HandleEvent (this=0x19aa3300, aEvent=0x19aa3df0) at ../../../../content/base/src/nsXMLHttpRequest.cpp:168
#17 0x135b8acf in nsEventListenerManager::HandleEventSubType (this=0x19aa3310, aListenerStruct=0x19aa3338, aListener=0x19aa3300, aDOMEvent=0x19aa3df0, aCurrentTarget=0x19aa3144, aPhaseFlags=6) at ../../../../content/events/src/nsEventListenerManager.cpp:1079
#18 0x135b8ecd in nsEventListenerManager::HandleEvent (this=0x19aa3310, aPresContext=0x0, aEvent=0x19ad8d80, aDOMEvent=0xbfffd7c0, aCurrentTarget=0x19aa3144, aFlags=6, aEventStatus=0xbfffd7c4) at ../../../../content/events/src/nsEventListenerManager.cpp:1176
#19 0x135eccc2 in nsEventTargetChainItem::HandleEvent (this=0x1e024a20, aVisitor=@0xbfffd7b8, aFlags=6, aMayHaveNewListenerManagers=1) at ../../../../content/events/src/nsEventDispatcher.cpp:227
#20 0x135ecf02 in nsEventTargetChainItem::HandleEventTargetChain (this=0x1e024a20, aVisitor=@0xbfffd7b8, aFlags=6, aCallback=0x0, aMayHaveNewListenerManagers=1) at ../../../../content/events/src/nsEventDispatcher.cpp:291
#21 0x135ed7d3 in nsEventDispatcher::Dispatch (aTarget=0x19aa3144, aPresContext=0x0, aEvent=0x19ad8d80, aDOMEvent=0x19aa3df0, aEventStatus=0x0, aCallback=0x0) at ../../../../content/events/src/nsEventDispatcher.cpp:508
#22 0x135edb38 in nsEventDispatcher::DispatchDOMEvent (aTarget=0x19aa3144, aEvent=0x0, aDOMEvent=0x19aa3df0, aPresContext=0x0, aEventStatus=0x0) at ../../../../content/events/src/nsEventDispatcher.cpp:570
#23 0x135927f0 in nsXHREventTarget::DispatchDOMEvent (this=0x19aa3140, aEvent=0x0, aDOMEvent=0x19aa3df0, aPresContext=0x0, aEventStatus=0x0) at ../../../../content/base/src/nsXMLHttpRequest.cpp:758
#24 0x13598515 in nsXMLHttpRequest::ChangeState (this=0x19aa3140, aState=16, aBroadcast=1) at ../../../../content/base/src/nsXMLHttpRequest.cpp:3098
#25 0x13599a34 in nsXMLHttpRequest::RequestCompleted (this=0x19aa3140) at ../../../../content/base/src/nsXMLHttpRequest.cpp:2345
#26 0x1359a13c in nsXMLHttpRequest::OnStopRequest (this=0x19aa3140, request=0x19aa35f0, ctxt=0x0, status=0) at ../../../../content/base/src/nsXMLHttpRequest.cpp:2301
#27 0x134ec3b5 in nsCrossSiteListenerProxy::OnStopRequest (this=0x19aa3cc0, aRequest=0x19aa35f0, aContext=0x0, aStatusCode=0) at ../../../../content/base/src/nsCrossSiteListenerProxy.cpp:280
#28 0x11a23b68 in nsStreamListenerTee::OnStopRequest (this=0x19a9cec0, request=0x19aa35f0, context=0x0, status=0) at ../../../../netwerk/base/src/nsStreamListenerTee.cpp:65
#29 0x11acfacb in nsHttpChannel::OnStopRequest (this=0x19aa35c0, request=0x19aa4130, ctxt=0x0, status=0) at ../../../../../netwerk/protocol/http/src/nsHttpChannel.cpp:4846
#30 0x119f0694 in nsInputStreamPump::OnStateStop (this=0x19aa4130) at ../../../../netwerk/base/src/nsInputStreamPump.cpp:576
#31 0x119f07b4 in nsInputStreamPump::OnInputStreamReady (this=0x19aa4130, stream=0x19aa401c) at ../../../../netwerk/base/src/nsInputStreamPump.cpp:401
#32 0x004fb53a in nsInputStreamReadyEvent::Run (this=0x19ab9ab0) at ../../../xpcom/io/nsStreamUtils.cpp:111
#33 0x0052dee8 in nsThread::ProcessNextEvent (this=0xc14d00, mayWait=0, result=0xbfffdc44) at ../../../xpcom/threads/nsThread.cpp:510
#34 0x004b6ab4 in NS_ProcessPendingEvents_P (thread=0xc14d00, timeout=20) at nsThreadUtils.cpp:180
#35 0x11d0cb8d in nsBaseAppShell::NativeEventCallback (this=0xc35700) at ../../../../widget/src/xpwidgets/nsBaseAppShell.cpp:121
#36 0x11cc3442 in nsAppShell::ProcessGeckoEvents (aInfo=0xc35700) at ../../../../widget/src/cocoa/nsAppShell.mm:381
#37 0x90df65f5 in CFRunLoopRunSpecific ()
#38 0x90df6cd8 in CFRunLoopRunInMode ()
#39 0x90fa32c0 in RunCurrentEventLoopInMode ()
#40 0x90fa30d9 in ReceiveNextEventCommon ()
#41 0x90fa2f4d in BlockUntilNextEventMatchingListInMode ()
#42 0x9013cd7d in _DPSNextEvent ()
#43 0x9013c630 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#44 0x9013566b in -[NSApplication run] ()
#45 0x11cc1ce6 in nsAppShell::Run (this=0xc35700) at ../../../../widget/src/cocoa/nsAppShell.mm:700
#46 0x129a5482 in nsAppStartup::Run (this=0xc4f260) at ../../../../../toolkit/components/startup/src/nsAppStartup.cpp:192
#47 0x000e30c6 in XRE_main (argc=1, argv=0xbffff2a0, aAppData=0xc0e6d0) at ../../../toolkit/xre/nsAppRunner.cpp:3216
#48 0x000027cb in main (argc=1, argv=0xbffff2a0) at ../../../browser/app/nsBrowserApp.cpp:156

Comment 3

[Jesse Ruderman]

WFM, mozilla-central.  The page loads fine, and even playing the timeline works.