Closed Bug 542135 Opened 15 years ago Closed 14 years ago

"Assertion failure: JSVAL_IS_OBJECT(vp[1]) || PRIMITIVE_THIS_TEST(fun, vp[1]), at ../jsops.cpp" (64-bit)

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: gkw, Unassigned)

Details

(Keywords: assertion, regression)

Assertion failure: JSVAL_IS_OBJECT(vp[1]) || PRIMITIVE_THIS_TEST(fun, vp[1]), at ../jsops.cpp:2270 This assert came about from jsfunfuzz but I don't have a reproducible testcase. Filing in case someone can figure out the cause. This occurred in 64-bit js debug shell on TM changeset 91ff07f7b562. http://hg.mozilla.org/tracemonkey/file/91ff07f7b562/js/src/jsops.cpp#l2270 Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Crashed Thread: 0 Dispatch queue: com.apple.main-thread Thread 0 Crashed: Dispatch queue: com.apple.main-thread 0 libSystem.B.dylib 0x00007fff8890bfe6 __kill + 10 1 js-dbg-64-tm-darwin 0x0000000100139685 JS_Assert + 70 2 js-dbg-64-tm-darwin 0x0000000100090f5e js_Interpret + 100699 3 js-dbg-64-tm-darwin 0x00000001000a4754 js_Execute + 1579 4 js-dbg-64-tm-darwin 0x00000001000bfe49 obj_eval(JSContext*, JSObject*, unsigned int, long*, long*) + 2899 5 js-dbg-64-tm-darwin 0x00000001000a56c2 js_Invoke + 2935 6 js-dbg-64-tm-darwin 0x000000010009112a js_Interpret + 101159 7 js-dbg-64-tm-darwin 0x00000001000a4754 js_Execute + 1579 8 js-dbg-64-tm-darwin 0x00000001000bfe49 obj_eval(JSContext*, JSObject*, unsigned int, long*, long*) + 2899 9 js-dbg-64-tm-darwin 0x00000001000a56c2 js_Invoke + 2935 10 js-dbg-64-tm-darwin 0x000000010009112a js_Interpret + 101159 11 js-dbg-64-tm-darwin 0x00000001000a4754 js_Execute + 1579 12 js-dbg-64-tm-darwin 0x00000001000115cc JS_ExecuteScript + 59 13 js-dbg-64-tm-darwin 0x0000000100009bfc Process(JSContext*, JSObject*, char*, int) + 471 (js.cpp:440) 14 js-dbg-64-tm-darwin 0x000000010000a6f1 ProcessArgs(JSContext*, JSObject*, char**, int) + 1692 (js.cpp:786) 15 js-dbg-64-tm-darwin 0x000000010000ab5b main + 777 (js.cpp:4903) 16 js-dbg-64-tm-darwin 0x0000000100001e16 _start + 224 17 js-dbg-64-tm-darwin 0x0000000100001d35 start + 33
Hardware: x86 → x86_64
In these cases, it would be nice to attach the script that triggered the crash, just in case running it ten thousand times can reproduce it, or something in the stack gives a strong hint as to where the problem might be.
I haven't seen this again in the past 6 months. -> WFM.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.