596145 - Assertion failure: obj->containsSlot(slot) visiting http://www.jdvhotels.com (JITs disabled)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Robert O'Callahan (:roc) (email my personal email if necessary)]

(gdb) where
#0  0x006ed889 in JS_Assert (s=0x82ed82 "obj->containsSlot(slot)", file=0x82e56c "/Users/roc/mozilla-checkin/js/src/jsinterp.cpp", ln=5183) at /Users/roc/mozilla-checkin/js/src/jsutil.cpp:80
#1  0x00626440 in js::Interpret (cx=0x306ac600, entryFrame=0x15967118, inlineCallCount=0, interpFlags=0) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:5183
#2  0x00635101 in js::RunScript (cx=0x306ac600, script=0x1b3a4860, fun=0x2d8207e0, scopeChain=0x2dfda318) at jsinterp.cpp:468
#3  0x006363b6 in js::Invoke (cx=0x306ac600, argsRef=@0xbfffb4c8, flags=0) at jsinterp.cpp:614
#4  0x005eff0b in js_fun_apply (cx=0x306ac600, argc=2, vp=0x159670e0) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:2385
#5  0x006218db in js::Interpret (cx=0x306ac600, entryFrame=0x15967070, inlineCallCount=0, interpFlags=0) at /Users/roc/mozilla-checkin/js/src/jsinterp.cpp:4611
#6  0x00635101 in js::RunScript (cx=0x306ac600, script=0x3087bb60, fun=0x2d818420, scopeChain=0x2ddcab40) at jsinterp.cpp:468
#7  0x006363b6 in js::Invoke (cx=0x306ac600, argsRef=@0xbfffc57c, flags=0) at jsinterp.cpp:614
#8  0x005ef708 in (anonymous namespace)::CallOrConstructBoundFunction (cx=0x306ac600, argc=1, vp=0x15967020) at /Users/roc/mozilla-checkin/js/src/jsfun.cpp:2519
#9  0x00637a5a in js::CallJSNative (cx=0x306ac600, native=0x5ef4a0 <(anonymous namespace)::CallOrConstructBoundFunction(JSContext*, unsigned int, js::Value*)>, argc=1, vp=0x15967020) at jscntxtinlines.h:614
#10 0x00635d66 in js::Invoke (cx=0x306ac600, argsRef=@0xbfffc6d4, flags=0) at jsinterp.cpp:510
#11 0x00636a8f in js::ExternalInvoke (cx=0x306ac600, thisv=@0xbfffc738, fval=@0xbfffc778, argc=1, argv=0xbfffc990, rval=0xbfffca08) at jsinterp.cpp:644
#12 0x00581f99 in js::ExternalInvoke (cx=0x306ac600, obj=0x2d99bea0, fval=@0xbfffc778, argc=1, argv=0xbfffc990, rval=0xbfffca08) at jsinterp.h:729
#13 0x005820bf in JS_CallFunctionValue (cx=0x306ac600, obj=0x2d99bea0, fval={asBits = 18446462629258699904, s = {payload = {i32 = 461087872, u32 = 461087872, boo = 461087872, str = 0x1b7ba480, obj = 0x1b7ba480, ptr = 0x1b7ba480, why = 461087872}, tag = JSVAL_TAG_OBJECT}, asDouble = -nan(0xf00071b7ba480), asPtr = 0x1b7ba480}, argc=1, argv=0xbfffc990, rval=0xbfffca08) at /Users/roc/mozilla-checkin/js/src/jsapi.cpp:4747
#14 0x13417ee8 in nsXPCWrappedJSClass::CallMethod (this=0x1ceb6520, wrapper=0x2e518b50, methodIndex=3, info=0x107ba28, nativeParams=0xbfffccac) at /Users/roc/mozilla-checkin/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1692
#15 0x1340e6ed in nsXPCWrappedJS::CallMethod (this=0x2e518b50, methodIndex=3, info=0x107ba28, params=0xbfffccac) at /Users/roc/mozilla-checkin/js/src/xpconnect/src/xpcwrappedjs.cpp:571
#16 0x00bb1038 in PrepareAndDispatch (self=0x2a6dfca0, methodIndex=3, args=0xbfffcdd4) at /Users/roc/mozilla-checkin/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
#17 0x00babb7b in nsXPTCStubBase::Stub3 (this=0x2a6dfca0) at xptcstubsdef.inc:1
#18 0x12cbb795 in nsDOMEventListenerWrapper::HandleEvent (this=0x2e518b90, aEvent=0x2c80a590) at /Users/roc/mozilla-checkin/content/events/src/nsDOMEventTargetHelper.cpp:65
#19 0x12c7669a in nsEventListenerManager::HandleEventSubType (this=0x2e518cc0, aListenerStruct=0x2e518ce8, aListener=0x2e518b90, aDOMEvent=0x2c80a590, aCurrentTarget=0x2e520b90, aPhaseFlags=6, aPusher=0xbfffd150) at /Users/roc/mozilla-checkin/content/events/src/nsEventListenerManager.cpp:1112
#20 0x12c76a7d in nsEventListenerManager::HandleEventInternal (this=0x2e518cc0, aPresContext=0x0, aEvent=0x244f6c40, aDOMEvent=0xbfffd168, aCurrentTarget=0x2e520b90, aFlags=6, aEventStatus=0xbfffd16c, aPusher=0xbfffd150) at /Users/roc/mozilla-checkin/content/events/src/nsEventListenerManager.cpp:1208
#21 0x12ca6f62 in nsEventListenerManager::HandleEvent (this=0x2e518cc0, aPresContext=0x0, aEvent=0x244f6c40, aDOMEvent=0xbfffd168, aCurrentTarget=0x2e520b90, aFlags=6, aEventStatus=0xbfffd16c, aPusher=0xbfffd150) at nsEventListenerManager.h:146
#22 0x12ca7125 in nsEventTargetChainItem::HandleEvent (this=0x1289140, aVisitor=@0xbfffd160, aFlags=6, aMayHaveNewListenerManagers=0, aPusher=0xbfffd150) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:212
#23 0x12ca5564 in nsEventTargetChainItem::HandleEventTargetChain (this=0x1289140, aVisitor=@0xbfffd160, aFlags=6, aCallback=0x0, aMayHaveNewListenerManagers=0, aPusher=0xbfffd150) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:341
#24 0x12ca6250 in nsEventDispatcher::Dispatch (aTarget=0x2e520b90, aPresContext=0x0, aEvent=0x244f6c40, aDOMEvent=0x2c80a590, aEventStatus=0x0, aCallback=0x0, aTargets=0x0) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:628
#25 0x12ca65d9 in nsEventDispatcher::DispatchDOMEvent (aTarget=0x2e520b90, aEvent=0x0, aDOMEvent=0x2c80a590, aPresContext=0x0, aEventStatus=0x0) at /Users/roc/mozilla-checkin/content/events/src/nsEventDispatcher.cpp:691
#26 0x12cbbca3 in nsDOMEventTargetHelper::DispatchDOMEvent (this=0x2e520b90, aEvent=0x0, aDOMEvent=0x2c80a590, aPresContext=0x0, aEventStatus=0x0) at /Users/roc/mozilla-checkin/content/events/src/nsDOMEventTargetHelper.cpp:229
#27 0x12c2a410 in nsXMLHttpRequest::ChangeState (this=0x2e520b90, aState=16, aBroadcast=1) at /Users/roc/mozilla-checkin/content/base/src/nsXMLHttpRequest.cpp:3003

(gdb) p ::DumpJSStack()
0 anonymous([object Event @ 0x31144780 (native @ 0x2c80a590)]) ["http://www.jdvhotels.com/js/mootools1.2.js":328]
    this = [object Object]
1 anonymous([object Event @ 0x31144780 (native @ 0x2c80a590)]) ["http://www.jdvhotels.com/js/mootools1.2.js":97]
    d = undefined
    f = undefined
    e = undefined
    this = [object Object]
$1 = void

(gdb) p slot
$2 = 183
(gdb) p obj
$3 = (JSObject *) 0x2dfda318
(gdb) p *obj
$4 = {
  {
    lastProp = 0x2c7a9a20, 
    map = 0x2c7a9a20
  }, 
  clasp = 0x1ecf57e4, 
  flags = 9, 
  objShape = 1566867, 
  proto = 0x2dfda870, 
  parent = 0x0, 
  dslots = 0x304a1a08, 
  emptyShape = 0x0, 
  fslots = {{
      data = {
        asBits = 15770157675600769408, 
        s = {
          payload = {
            i32 = 571830656, 
            u32 = 571830656, 
            boo = 571830656, 
            str = 0x22157180, 
            obj = 0x22157180, 
            ptr = 0x22157180, 
            why = 571830656
          }, 
          tag = -623191334
        }, 
        asDouble = -4.6537338918272667e+129, 
        asPtr = 0x22157180
      }
    }, {
      data = {
        asBits = 18446462607322775552, 
        s = {
          payload = {
            i32 = 0, 
            u32 = 0, 
            boo = 0, 
            str = 0x0, 
            obj = 0x0, 
            ptr = 0x0, 
            why = JS_ARRAY_HOLE
          }, 
          tag = JSVAL_TAG_UNDEFINED
        }, 
        asDouble = -nan(0xf000200000000), 
        asPtr = 0x0
      }
    }, {
      data = {
        asBits = 18446462629258750304, 
        s = {
          payload = {
            i32 = 461138272, 
            u32 = 461138272, 
            boo = 461138272, 
            str = 0x1b7c6960, 
            obj = 0x1b7c6960, 
            ptr = 0x1b7c6960, 
            why = 461138272
          }, 
          tag = JSVAL_TAG_OBJECT
        }, 
        asDouble = -nan(0xf00071b7c6960), 
        asPtr = 0x1b7c6960
      }
    }}, 
  title = {
    ownercx = 0x306ac600, 
    lock = {
      owner = 0, 
      fat = 0x0
    }, 
    u = {
      count = 0, 
      link = 0x0
    }
  },

Comment 1

[Robert Sayre]

WFM. Reopen if it still repros.