576101 - Assertion failure: entry->localKind == JSLOCAL_ARG && localKind == JSLOCAL_ARG

Status: RESOLVED DUPLICATE of bug 568276

(Core :: JavaScript Engine, defect)

Description

[Nicolai Stange]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100423 Ubuntu/10.04 (lucid) Firefox/3.6.3
Build Identifier: http://releases.mozilla.org/pub/mozilla.org/firefox/releases/3.6.6/source/firefox-3.6.6.source.tar.bz2

At first I'm sorry, I've got no example where you don't need to login, but maybe my attached gdb session will tell you everything you need.

Since my (self-compiled) FF 3.6.6 crashed on Solaris10/SPARC within yahoo's webmail (as soon as one logs in), I created a Debug build and now the following happens:
The assertion in 
mozilla-1.9.2/js/src/jsfun.cpp:2715
fails.

Looking at my backtrace in gdb, I assume that the problem is here:
mozilla-1.9.2/js/src/jsfun.cpp:2837

Maybe s/JSLOCAL_VAR/JSLOCAL_ARG/ would help?

I wonder if this could have to do sth. with my segmentation fault I encounter with the non-debug built.


Reproducible: Always

Steps to Reproduce:
1. Go to the http://mail.yahoo.com/
2. Login
Actual Results:  
jsfun.cpp:2715 assertion fails.


(gdb) bt
#0  0xff1caa58 in _lwp_kill () from /lib/libc.so.1
#1  0xff165a64 in raise () from /lib/libc.so.1
#2  0xff141914 in abort () from /lib/libc.so.1
#3  0xfb4cc92c in JS_Assert (s=0xfb605998 <error reading variable>, 
    file=0xfb604c38 <error reading variable>, ln=2715)
    at /opt/zmaw/sw/solaris10/ff_build/mozilla-1.9.2/js/src/jsutil.cpp:69
#4  0xfb3dcd10 in HashLocalName (cx=0xf39b3800, map=0xf09e44d0, name=0xfb64b384, 
    localKind=JSLOCAL_VAR, index=13)
    at /opt/zmaw/sw/solaris10/ff_build/mozilla-1.9.2/js/src/jsfun.cpp:2715
#5  0xfb3dd4bc in js_AddLocal (cx=0xf39b3800, fun=0xef63d770, atom=0xfb64b384, kind=JSLOCAL_VAR)
    at /opt/zmaw/sw/solaris10/ff_build/mozilla-1.9.2/js/src/jsfun.cpp:2837
#6  0xfb47d280 in FunctionDef (cx=0xf39b3800, ts=0xffbfdcb8, tc=0xffbfd250, lambda=0)

(gdb) up 4
#4  0xfb3dcd10 in HashLocalName (cx=0xf39b3800, map=0xf09e44d0, name=0xfb64b384, 
    localKind=JSLOCAL_VAR, index=13)
    at /opt/zmaw/sw/solaris10/ff_build/mozilla-1.9.2/js/src/jsfun.cpp:2715
2715            JS_ASSERT(entry->localKind == JSLOCAL_ARG && localKind == JSLOCAL_ARG);
(gdb) p *entry
$10 = {hdr = {keyHash = 2474559385}, name = 0xfb64b384, index = 0, 
  localKind = 1 '<error reading variable>}
(gdb) p localKind
$11 = JSLOCAL_VAR
(gdb) p /x JSLOCAL_ARG
$7 = 0x1
(gdb) p /x JSLOCAL_VAR
$8 = 0x2

Comment 1

[Nicolai Stange]

The same is true for a Debug Build on Debian Lenny (x64_86):
Assertion failure: entry->localKind == JSLOCAL_ARG && localKind == JSLOCAL_ARG, at /zmaw/sw/sw/lenny-x64/ff_build/mozilla-1.9.2/js/src/jsfun.cpp:2715

Comment 2

[Bob Clary [:bc] (inactive)]

dupe of bug 568276 ?

Comment 3

[Nicolai Stange]

(In reply to comment #2)
> dupe of bug 568276 ?

If in jsparser.cpp
FunctionDef 
became 
js::Parser::functionDef
in the meanwhile (that is between 3.6.6 release and http://hg.mozilla.org/rev/13b292f9ab79
definitely yes. Even the URL of failure is the same.

Comment 4

[Bob Clary [:bc] (inactive)]

K. Thanks!