Closed Bug 518279 Opened 15 years ago Closed 15 years ago

Assertion failure: v == LOCKED_OBJ_GET_SLOT(pobj, sprop->slot)

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 517637

People

(Reporter: roc, Unassigned)

References

(
URL
)

Details

Program received signal SIGTRAP, Trace/breakpoint trap.
JS_Assert (s=0x434a14 "v == LOCKED_OBJ_GET_SLOT(pobj, sprop->slot)", file=0x4330a0 "/Users/roc/mozilla-checkin/js/src/jsinterp.cpp", ln=201) at /Users/roc/mozilla-checkin/js/src/jsutil.cpp:69
69	    abort();
(gdb) where
#0  JS_Assert (s=0x434a14 "v == LOCKED_OBJ_GET_SLOT(pobj, sprop->slot)", file=0x4330a0 "/Users/roc/mozilla-checkin/js/src/jsinterp.cpp", ln=201) at /Users/roc/mozilla-checkin/js/src/jsutil.cpp:69
#1  0x0031b802 in js_FillPropertyCache (cx=0x4853d800, obj=0x808e000, scopeIndex=0, protoIndex=0, pobj=0x808e000, sprop=0x35981330, adding=0) at jsinterp.cpp:201
#2  0x00337ac9 in js_GetPropertyHelper (cx=0x4853d800, obj=0x808e000, id=552560900, getHow=3, vp=0xbfffacc4) at /Users/roc/mozilla-checkin/js/src/jsobj.cpp:4424
#3  0x00337bb1 in js_GetMethod (cx=0x4853d800, obj=0x808e000, id=552560900, getHow=3, vp=0xbfffacc4) at /Users/roc/mozilla-checkin/js/src/jsobj.cpp:4447
#4  0x003073cb in js_Interpret (cx=0x4853d800) at jsops.cpp:1627
#5  0x0031f1b8 in js_Invoke (cx=0x4853d800, argc=0, vp=0x4962e054, flags=0) at jsinterp.cpp:1385
#6  0x002e4504 in js_fun_apply (cx=0x4853d800, argc=0, vp=0x4962e01c) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:2072
#7  0x0030aba8 in js_Interpret (cx=0x4853d800) at jsops.cpp:2235
#8  0x0031f1b8 in js_Invoke (cx=0x4853d800, argc=3, vp=0x4962df0c, flags=0) at jsinterp.cpp:1385
#9  0x002abd7f in array_extra (cx=0x4853d800, mode=FOREACH, argc=3, vp=0x4962dee4) at /Users/roc/mozilla-checkin/js/src/jsarray.cpp:3219
#10 0x002ac00e in array_forEach (cx=0x4853d800, argc=2, vp=0x4962dee4) at /Users/roc/mozilla-checkin/js/src/jsarray.cpp:3275
#11 0x0030aba8 in js_Interpret (cx=0x4853d800) at jsops.cpp:2235
#12 0x0031f1b8 in js_Invoke (cx=0x4853d800, argc=0, vp=0x4962de60, flags=0) at jsinterp.cpp:1385
#13 0x002e412a in js_fun_call (cx=0x4853d800, argc=0, vp=0x4962de2c) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:1981
#14 0x0030aba8 in js_Interpret (cx=0x4853d800) at jsops.cpp:2235
#15 0x0031f1b8 in js_Invoke (cx=0x4853d800, argc=1, vp=0x4962de20, flags=0) at jsinterp.cpp:1385
#16 0x05a2119e in nsXPCWrappedJSClass::CallMethod (this=0x8173b20, wrapper=0x43e6ebf0, methodIndex=3, info=0x10dcc60, nativeParams=0xbfffcd54) at /Users/roc/mozilla-checkin/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1671
#17 0x05a18211 in nsXPCWrappedJS::CallMethod (this=0x43e6ebf0, methodIndex=3, info=0x10dcc60, params=0xbfffcd54) at /Users/roc/mozilla-checkin/js/src/xpconnect/src/xpcwrappedjs.cpp:570
#18 0x005badfa in PrepareAndDispatch (self=0xdb9cb20, methodIndex=3, args=0xbfffce74) at /Users/roc/mozilla-checkin/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
#19 0x005bae59 in nsXPTCStubBase::Stub3 (this=0xdb9cb20) at xptcstubsdef.inc:1
#20 0x02d480b7 in nsEventListenerManager::HandleEventSubType (this=0xdb3f8a0, aListenerStruct=0x2bf81798, aListener=0xdb9cb20, aDOMEvent=0x2b83dab0, aCurrentTarget=0xeed2600, aPhaseFlags=6) at /Users/roc/mozilla-checkin/content/events/src/nsEventListenerManager.cpp:1034


0 anonymous(pageNum = 0) ["http://w.sharethis.com/share3x/js/all.4.1.0-rc3.js":1]
    element = http://blogmarks.net/my/new.php?mini=1&url=&title=
    i = 10
    itemsPerPage = 12
ct Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]) ["http://w.sharethis.com/share3x/js/all.4.1.0-rc3.js":1]
    this = [object Object]
3 createSwList() ["http://w.sharethis.com/share3x/js/all.4.1.0-rc3.js":1]
    respectUserPrefs = false
    publisherPrefs = facebook,myspace,delicious,technorati,propeller,mixx,newsvine,google_bmarks,yahoo_myweb,windows_live,tailrank,magnolia,furl,blinklist,blogmarks
    userPrefs = 
    defaultServices = myspace,digg,sms,windows_live,delicious,stumbleupon,reddit,google_bmarks,linkedin,bebo,ybuzz,blogger,yahoo_bmarks,mixx,technorati,friendfeed,propeller,wordpress,newsvine,xanga,blinklist,twine,twackle,diigo,fark,faves,mister_wong,current,livejournal,kirtsy,slashdot,oknotizie,care2,aim,meneame,simpy,blogmarks,n4g,bus_exchange,funp,sphinn,fresqui,dealsplus,typepad,yigg
    defaultServicesCSV = "myspace,digg,sms,windows_live,delicious,stumbleupon,reddit,google_bmarks,linkedin,bebo,ybuzz,blogger,yahoo_bmarks,mixx,technorati,friendfeed,propeller,wordpress,newsvine,xanga,blinklist,twine,twackle,diigo,fark,faves,mister_wong,current,livejournal,kirtsy,slashdot,oknotizie,care2,aim,meneame,simpy,blogmarks,n4g,bus_exchange,funp,sphinn,fresqui,dealsplus,typepad,yigg"
    carouselItems = [object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
    this = [object Window @ 0x27c2c5c0 (native @ 0x43c5ece0)]
4 processBuffer() ["http://w.sharethis.com/share3x/js/all.4.1.0-rc3.js":1]
    request = undefined
    i = 13
    this = [object Window @ 0x27c2c5c0 (native @ 0x43c5ece0)]
5 anonymous() ["http://w.sharethis.com/share3x/js/all.4.1.0-rc3.js":1]
    authCookie = undefined
    a = undefined
    html_str = "try{var pageTracker = _gat._getTracker("UA-1645146-9");pageTracker._trackPageview();} catch(err) {}"
    newScript = [object HTMLScriptElement @ 0x298e1810 (native @ 0xf6c1500)]
    headID = [object HTMLHeadElement @ 0x9a962e0 (native @ 0x27aeb750)]
    gaJsHost = "http://www."
    this = [object Window @ 0x27c2c5c0 (native @ 0x43c5ece0)]
6 anonymous() ["http://w.sharethis.com/share3x/js/mootools-1.2.1-core-nc.js":1]
    this = [object Window @ 0x27c2c5c0 (native @ 0x43c5ece0)]
7 anonymous(event = undefined) ["http://w.sharethis.com/share3x/js/mootools-1.2.1-core-nc.js":1]
    returns = [function]
    args = 
    this = [object Window @ 0x27c2c5c0 (native @ 0x43c5ece0)]
8 anonymous(fn = [function], 0, [function]) ["http://w.sharethis.com/share3x/js/mootools-1.2.1-core-nc.js":1]
    this = [object Window @ 0x27c2c5c0 (native @ 0x43c5ece0)]
9 anonymous(delay = undefined, args = undefined, type = "domready") ["http://w.sharethis.com/share3x/js/mootools-1.2.1-core-nc.js":1]
    events = [object Object]
    this = [object Window @ 0x27c2c5c0 (native @ 0x43c5ece0)]
10 anonymous() ["http://w.sharethis.com/share3x/js/mootools-1.2.1-core-nc.js":1]
    this = [object HTMLDocument @ 0x2980a120 (nativp sprope @ 0xeed2600)]
11 anonymous([object Event @ 0x27e34820 (native @ 0x2b83dab0)]) ["http://w.sharethis.com/share3x/js/mootools-1.2.1-core-nc.js":1]
    this = [object HTMLDocument @ 0x2980a120 (native @ 0xeed2600)]


(gdb) up
#1  0x0031b802 in js_FillPropertyCache (cx=0x4853d800, obj=0x808e000, scopeIndex=0, protoIndex=0, pobj=0x808e000, sprop=0x35981330, adding=0) at jsinterp.cpp:201
201	                JS_ASSERT(v == LOCKED_OBJ_GET_SLOT(pobj, sprop->slot));
(gdb) p pobj
$2 = (JSObject *) 0x808e000
(gdb) p *pobj
$3 = {
  map = 0x262d3c60, 
  classword = 4511264, 
  fslots = {191829344, 191829312, 134799424, 134799488, 22}, 
  dslots = 0x0
}
(gdb) p *sprop
$4 = {
  id = 552560900, 
  getter = 0x21ab8c78, 
  setter = 0, 
  slot = 3, 
  attrs = 1 '\001', 
  flags = 16 '\020', 
  shortid = 0, 
  parent = 0x359813b0, 
  kids = 0x0, 
  shape = 3949610
}
(gdb) p v
$5 = 564890744
Flags: blocking1.9.2?
It's probably something that's been fixed in TM: I loaded that page with no assert in a TM debug build I made yesterday.
Flags: blocking1.9.2? → blocking1.9.2+
I hit this twice this morning browsing the San Francisco Chronicle (sfgate.com), but couldn't repro on the same URLs later.  (64-bit Linux)
Priority: -- → P1
Who owns this?  It's a P1 beta blocker.  Need an owner ASAP.
I think this was probably fixed by a tracemonkey merge a few days ago.
Can we get a confirmation that it was fixed, please?
(In reply to comment #6)
> Can we get a confirmation that it was fixed, please?

checking/testing!
(In reply to comment #6)
> Can we get a confirmation that it was fixed, please?

no crash with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2b1pre) Gecko/20090930 Firefox/3.6b1pre on the test url- so yes seems to be fixed by the TM merge
(In reply to comment #9)
> That's a debug build, right?

yep, building was about 2 hours ago (sorry forgot to mention this)
Looks like a duplicate of bug 518830 (including the sharethis stuff, etc).  Marking duplicate of bug 517637 (which bug 518830 is a duplicate of itself).
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.