Closed
Bug 606083
Opened 15 years ago
Closed 15 years ago
Assertion failure: !TRACE_RECORDER(cx), at js/src/jsinterp.cpp:6932
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: bc, Assigned: dvander)
References
()
Details
(Keywords: crash, Whiteboard: fixed-in-tracemonkey)
Attachments
(2 files)
55.47 KB,
text/plain
|
Details | |
1.05 KB,
patch
|
billm
:
review+
|
Details | Diff | Splinter Review |
mozilla central 4da5ab8255ec tip 32bit vista only so far.
1. <http://maps.google.de/maps?f=q%26source=s_q%26output=js%26hl=de%26geocode=%26abauth=4cb403338--OrcajRquW5QccXAx3b6HxvTo%26q=Wilderich-Lang-Strasse%2B4%26btnG=Maps-Suche%26vps=2%26jsv=284c%26sll=48.148203%252C11.535789%26sspn=0.007473%252C0.018947%26gl=de%26g=Wilderich-Lang-Strasse%2B4>
2. Assertion failure: !TRACE_RECORDER(cx), at c:/work/mozilla/builds/2.0.0/mozilla/js/src/jsinterp.cpp:6932
chofmann, laura: re bug 579136, this crash generated 6 dump identical dump files.
Comment 1•15 years ago
|
||
bc, good catch. could you figure out if the reports are dup'ed on the client, or is there a single instance of the report there, and just dups on the server?
Reporter | ||
Comment 2•15 years ago
|
||
duped on the client. I generate a crash report for each dmp file found. there were 6 for this crash/assertion.
Reporter | ||
Comment 3•15 years ago
|
||
also windows xp.
Comment 5•15 years ago
|
||
I assume you're only hitting this on debug builds, since it's an assertion failure?
Reporter | ||
Comment 6•15 years ago
|
||
y
Comment 7•15 years ago
|
||
I grabbed a debug build from tinderbox-builds, ran it locally (Win7 x64), loaded that URL and hit the assertion. I only wound up with one minidump, though.
Comment 8•15 years ago
|
||
Bob, do you always get six?
Comment 9•15 years ago
|
||
(gdb) bt
#0 0x00000037ed40efbb in raise () from /lib64/libpthread.so.0
#1 0x00007ffff6a9e9d8 in JS_Assert (s=0x7ffff73484c7 "!TRACE_RECORDER(cx)",
file=0x7ffff73482d8 "../../../mozilla/js/src/jsinterp.cpp", ln=6932)
at ../../../mozilla/js/src/jsutil.cpp:83
#2 0x00007ffff6c065dd in js::Interpret (cx=0x7fffe0ff2000, entryFrame=
0x7fffe8bfd318, inlineCallCount=0, interpMode=JSINTERP_RECORD)
at ../../../mozilla/js/src/jsinterp.cpp:6932
#3 0x00007ffff6af7596 in js::MonitorTracePoint (cx=0x7fffe0ff2000,
inlineCallCount=@0x7fffffffa610, blacklist=@0x7fffffffa617)
at ../../../mozilla/js/src/jstracer.cpp:16731
#4 0x00007ffff6b8de03 in RunTracer (f=..., tic=...)
at ../../../mozilla/js/src/methodjit/InvokeHelpers.cpp:944
#5 0x00007ffff6b8e0f2 in js::mjit::stubs::InvokeTracer (f=..., tic=
0x7fffc8e98d88) at ../../../mozilla/js/src/methodjit/InvokeHelpers.cpp:1034
#6 0x00007fffcbc3e9bd in ?? ()
#7 0x00007fffc90bb568 in ?? ()
#8 0x0000000000000001 in ?? ()
#9 0x00007fffffffa6f0 in ?? ()
#10 0x00007fffffffaa90 in ?? ()
#11 0x00007fffffffa73c in ?? ()
#12 0x00007fffe8bfd418 in ?? ()
#13 0x00007fffc8911829 in ?? ()
#14 0x00007fffe8bfd3b8 in ?? ()
#15 0x00007fffe0ff2000 in ?? ()
#16 0x00007fffe8ca71b0 in ?? ()
#17 0x00007fffe8bfd288 in ?? ()
#18 0x00007fffe8bfd288 in ?? ()
#19 0xfffbffffdd887500 in ?? ()
#20 0x00007fffffffffff in ?? ()
#21 0xffff800000000000 in ?? ()
#22 0x0000000000002000 in ?? ()
#23 0x00007fffffffa780 in ?? ()
#24 0x00007ffff6b396df in js::mjit::EnterMethodJIT (cx=0x7fffe8bfd418, fp=
0x7fffffffa73c, code=0x7fffffffaa90, stackLimit=0x7fffffffa6f0)
at ../../../mozilla/js/src/methodjit/MethodJIT.cpp:742
Backtrace stopped: frame did not save the PC
Comment 10•15 years ago
|
||
JS stack:
(gdb) call DumpJSStack()
[Thread 0x7fffdedfe710 (LWP 1508) exited]
[Thread 0x7fffd06ff710 (LWP 1008) exited]
[Thread 0x7fffc88fe710 (LWP 1024) exited]
[Thread 0x7fffcbaff710 (LWP 1020) exited]
[Thread 0x7fffcc6ff710 (LWP 1019) exited]
0 Nk(c = undefined, b = [object HTMLHeadElement @ 0x7fffdd8d23c0 (native @ 0x7fffd0a93d40)], a = "lcs_c") ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":782]
j = "lt_c"
g = [object HTMLStyleElement @ 0x7fffc585b4b0 (native @ 0x7fffc6afcce0)]
f = 4
e = [object HTMLCollection @ 0x7fffdd8d2438 (native @ 0x7fffcc8a4600)]
d = [object HTMLStyleElement @ 0x7fffc585d1e0 (native @ 0x7fffcdc62840)]
this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
1 anonymous([object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":495]
b = "GAddMessages({});X("lcs_c",Pc,q);X("lcs_c");"
a = "lcs_c"
this = [object Object]
2 anonymous([object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":19]
this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
3 anonymous(a = [object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":468]
d = 1287769942135
c = [function]
b = [function]
this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
4 anonymous() ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":470]
this = [object Object]
5 anonymous(1) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":333]
this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
![]() |
Assignee | |
Comment 11•15 years ago
|
||
The assert might be bogus, but really the tracer should stop here.
Comment on attachment 485359 [details] [diff] [review]
fix
Seems good to me.
Attachment #485359 -
Flags: review?(wmccloskey) → review+
![]() |
Assignee | |
Comment 13•15 years ago
|
||
Whiteboard: fixed-in-tracemonkey
Comment 14•15 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•