512516 - Abort on startup: Assertion failure: JSVAL_IS_OBJECT(v), at /mozilla/js/src/jsapi.h:183

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Daniel Holbert [:dholbert]]

After updating my debug build this morning, I've started hitting this assertion/abort on Firefox startup:

> Assertion failure: JSVAL_IS_OBJECT(v), at /mozilla/js/src/jsapi.h:183
> Trace/breakpoint trap

This is in a debug build at revision 2f27256aa154.
Platform is Ubuntu 9.04 (Linux).
I'm invoking firefox with no arguments and with a fresh profile.

I suspect this morning's Tracemonkey merge...
http://hg.mozilla.org/mozilla-central/rev/189759c41621

Comment 1

[Daniel Holbert [:dholbert]]

This happens on two separate machines -- my ThinkPad laptop and my Dell desktop (both 32-bit, both running Ubuntu 9.04).  So, I'm guessing this should be reproducible on any Ubuntu 9.04 box.

Comment 2

[Daniel Holbert [:dholbert]]

Attachment: backtrace at abort

Comment 3

[Daniel Holbert [:dholbert]]

Attachment: "bt full" version of above backtrace

here's the "bt full" version of the above backtrace (with local variables).  It goes up to stack level #11.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Assertion rendered invalid by bug 512029 - pushed fix to tm here:

http://hg.mozilla.org/tracemonkey/rev/3e02f9467ac1

Comment 5

[Daniel Holbert [:dholbert]]

Sayrer pushed fix to m-c in bug 512029 comment 10, fixing this. Thanks!