542135 - "Assertion failure: JSVAL_IS_OBJECT(vp[1]) || PRIMITIVE_THIS_TEST(fun, vp[1]), at ../jsops.cpp" (64-bit)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Assertion failure: JSVAL_IS_OBJECT(vp[1]) || PRIMITIVE_THIS_TEST(fun, vp[1]), at ../jsops.cpp:2270

This assert came about from jsfunfuzz but I don't have a reproducible testcase. Filing in case someone can figure out the cause. This occurred in 64-bit js debug shell on TM changeset 91ff07f7b562.

http://hg.mozilla.org/tracemonkey/file/91ff07f7b562/js/src/jsops.cpp#l2270

Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   libSystem.B.dylib             	0x00007fff8890bfe6 __kill + 10
1   js-dbg-64-tm-darwin           	0x0000000100139685 JS_Assert + 70
2   js-dbg-64-tm-darwin           	0x0000000100090f5e js_Interpret + 100699
3   js-dbg-64-tm-darwin           	0x00000001000a4754 js_Execute + 1579
4   js-dbg-64-tm-darwin           	0x00000001000bfe49 obj_eval(JSContext*, JSObject*, unsigned int, long*, long*) + 2899
5   js-dbg-64-tm-darwin           	0x00000001000a56c2 js_Invoke + 2935
6   js-dbg-64-tm-darwin           	0x000000010009112a js_Interpret + 101159
7   js-dbg-64-tm-darwin           	0x00000001000a4754 js_Execute + 1579
8   js-dbg-64-tm-darwin           	0x00000001000bfe49 obj_eval(JSContext*, JSObject*, unsigned int, long*, long*) + 2899
9   js-dbg-64-tm-darwin           	0x00000001000a56c2 js_Invoke + 2935
10  js-dbg-64-tm-darwin           	0x000000010009112a js_Interpret + 101159
11  js-dbg-64-tm-darwin           	0x00000001000a4754 js_Execute + 1579
12  js-dbg-64-tm-darwin           	0x00000001000115cc JS_ExecuteScript + 59
13  js-dbg-64-tm-darwin           	0x0000000100009bfc Process(JSContext*, JSObject*, char*, int) + 471 (js.cpp:440)
14  js-dbg-64-tm-darwin           	0x000000010000a6f1 ProcessArgs(JSContext*, JSObject*, char**, int) + 1692 (js.cpp:786)
15  js-dbg-64-tm-darwin           	0x000000010000ab5b main + 777 (js.cpp:4903)
16  js-dbg-64-tm-darwin           	0x0000000100001e16 _start + 224
17  js-dbg-64-tm-darwin           	0x0000000100001d35 start + 33

Comment 1

[Jason Orendorff [:jorendorff]]

In these cases, it would be nice to attach the script that triggered the crash, just in case running it ten thousand times can reproduce it, or something in the stack gives a strong hint as to where the problem might be.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I haven't seen this again in the past 6 months. -> WFM.