495151 - "Assertion failure: slot < OBJ_SCOPE(obj)->freeslot"

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: stack trace

Assertion failure: slot < OBJ_SCOPE(obj)->freeslot, at /Users/jruderman/central/js/src/jsinterp.cpp:5764

I can reproduce today, but probably won't be able to for much longer.

Comment 1

[Jesse Ruderman]

Attachment: js_DumpScript output

Got it in gdb again, and Gal showed me how to get bytecode disassembly of the relevant script.

Comment 2

[Igor Bukanov]

I will have a look to find out what is going on.

Comment 3

[Igor Bukanov]

Is it possible to reproduce this again?

Comment 4

[Jesse Ruderman]

Probably not.  I'll know for sure on Monday.

Comment 5

[Jesse Ruderman]

No, but I'll notice if it happens again.

Comment 6

[Bob Clary [:bc] (inactive)]

I saw this yesterday during at http://www.worstpreviews.com/trailer.php?id=1373&item=0 on an xserve but can not reproduce on my macbook.

Comment 7

[Bob Clary [:bc] (inactive)]

ditto http://www.bloomberg.com/markets/currencies/fxc.html
fyi the xserve is a xserve1,1 with a dual core xeon running 10.4.11

Comment 8

[Michal Novotny [:michal]]

Attachment: native stack, JS stack and js_DumpScript output

I get this assertion on my linux box once or twice a day. Native stack, JS stack and js_DumpScript output are in the zip archive.

Comment 9

[Carsten Book [:Tomcat]]

also running into this during a topsite test with a 1.9.1 debug build :Assertion failure: slot < OBJ_SCOPE(obj)->freeslot, at /work/mozilla/builds/1.9.1/mozilla/js/src/jsinterp.cpp:5839
http://www.indiatimes.com: EXIT STATUS: CRASHED signal 5 SIGTRAP (287.495520 seconds)

but so far not able to reproduce this manually

Comment 10

[Carsten Book [:Tomcat]]

Attachment: stack from http://www.weather.com/outlook/travel/businesstraveler/wxclimatology/daily/70118?climoMonth%3D12

note: i see this during the crash automation a lot of time, so far i was not able to reproduce this , but at least i got a stack. url used for this test was http://www.weather.com/outlook/travel/businesstraveler/wxclimatology/daily/70118?climoMonth%3D12

Comment 11

[Igor Bukanov]

JSObject changed to much for this bug to be relevant.

Comment 12

[Bob Clary [:bc] (inactive)]

FYI, this is reproducible on Firefox 3.6 (1.9.2) Mac, Linux, Windows at http://www.tgdaily.com/hardware-brief/55358-mythbuster-hyneman-designs-next-gen-military-armor