Closed Bug 606083 Opened 15 years ago Closed 15 years ago

Assertion failure: !TRACE_RECORDER(cx), at js/src/jsinterp.cpp:6932

Categories

(Core :: JavaScript Engine, defect)

x86
All
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: bc, Assigned: dvander)

References

()

Details

(Keywords: crash, Whiteboard: fixed-in-tracemonkey)

Attachments

(2 files)

Attached file stack
mozilla central 4da5ab8255ec tip 32bit vista only so far. 1. <http://maps.google.de/maps?f=q%26source=s_q%26output=js%26hl=de%26geocode=%26abauth=4cb403338--OrcajRquW5QccXAx3b6HxvTo%26q=Wilderich-Lang-Strasse%2B4%26btnG=Maps-Suche%26vps=2%26jsv=284c%26sll=48.148203%252C11.535789%26sspn=0.007473%252C0.018947%26gl=de%26g=Wilderich-Lang-Strasse%2B4> 2. Assertion failure: !TRACE_RECORDER(cx), at c:/work/mozilla/builds/2.0.0/mozilla/js/src/jsinterp.cpp:6932 chofmann, laura: re bug 579136, this crash generated 6 dump identical dump files.
Depends on: 579136
bc, good catch. could you figure out if the reports are dup'ed on the client, or is there a single instance of the report there, and just dups on the server?
duped on the client. I generate a crash report for each dmp file found. there were 6 for this crash/assertion.
also windows xp.
and linux.
OS: Windows Vista → All
I assume you're only hitting this on debug builds, since it's an assertion failure?
y
I grabbed a debug build from tinderbox-builds, ran it locally (Win7 x64), loaded that URL and hit the assertion. I only wound up with one minidump, though.
Bob, do you always get six?
(gdb) bt #0 0x00000037ed40efbb in raise () from /lib64/libpthread.so.0 #1 0x00007ffff6a9e9d8 in JS_Assert (s=0x7ffff73484c7 "!TRACE_RECORDER(cx)", file=0x7ffff73482d8 "../../../mozilla/js/src/jsinterp.cpp", ln=6932) at ../../../mozilla/js/src/jsutil.cpp:83 #2 0x00007ffff6c065dd in js::Interpret (cx=0x7fffe0ff2000, entryFrame= 0x7fffe8bfd318, inlineCallCount=0, interpMode=JSINTERP_RECORD) at ../../../mozilla/js/src/jsinterp.cpp:6932 #3 0x00007ffff6af7596 in js::MonitorTracePoint (cx=0x7fffe0ff2000, inlineCallCount=@0x7fffffffa610, blacklist=@0x7fffffffa617) at ../../../mozilla/js/src/jstracer.cpp:16731 #4 0x00007ffff6b8de03 in RunTracer (f=..., tic=...) at ../../../mozilla/js/src/methodjit/InvokeHelpers.cpp:944 #5 0x00007ffff6b8e0f2 in js::mjit::stubs::InvokeTracer (f=..., tic= 0x7fffc8e98d88) at ../../../mozilla/js/src/methodjit/InvokeHelpers.cpp:1034 #6 0x00007fffcbc3e9bd in ?? () #7 0x00007fffc90bb568 in ?? () #8 0x0000000000000001 in ?? () #9 0x00007fffffffa6f0 in ?? () #10 0x00007fffffffaa90 in ?? () #11 0x00007fffffffa73c in ?? () #12 0x00007fffe8bfd418 in ?? () #13 0x00007fffc8911829 in ?? () #14 0x00007fffe8bfd3b8 in ?? () #15 0x00007fffe0ff2000 in ?? () #16 0x00007fffe8ca71b0 in ?? () #17 0x00007fffe8bfd288 in ?? () #18 0x00007fffe8bfd288 in ?? () #19 0xfffbffffdd887500 in ?? () #20 0x00007fffffffffff in ?? () #21 0xffff800000000000 in ?? () #22 0x0000000000002000 in ?? () #23 0x00007fffffffa780 in ?? () #24 0x00007ffff6b396df in js::mjit::EnterMethodJIT (cx=0x7fffe8bfd418, fp= 0x7fffffffa73c, code=0x7fffffffaa90, stackLimit=0x7fffffffa6f0) at ../../../mozilla/js/src/methodjit/MethodJIT.cpp:742 Backtrace stopped: frame did not save the PC
JS stack: (gdb) call DumpJSStack() [Thread 0x7fffdedfe710 (LWP 1508) exited] [Thread 0x7fffd06ff710 (LWP 1008) exited] [Thread 0x7fffc88fe710 (LWP 1024) exited] [Thread 0x7fffcbaff710 (LWP 1020) exited] [Thread 0x7fffcc6ff710 (LWP 1019) exited] 0 Nk(c = undefined, b = [object HTMLHeadElement @ 0x7fffdd8d23c0 (native @ 0x7fffd0a93d40)], a = "lcs_c") ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":782] j = "lt_c" g = [object HTMLStyleElement @ 0x7fffc585b4b0 (native @ 0x7fffc6afcce0)] f = 4 e = [object HTMLCollection @ 0x7fffdd8d2438 (native @ 0x7fffcc8a4600)] d = [object HTMLStyleElement @ 0x7fffc585d1e0 (native @ 0x7fffcdc62840)] this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)] 1 anonymous([object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":495] b = "GAddMessages({});X("lcs_c",Pc,q);X("lcs_c");" a = "lcs_c" this = [object Object] 2 anonymous([object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":19] this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)] 3 anonymous(a = [object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":468] d = 1287769942135 c = [function] b = [function] this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)] 4 anonymous() ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":470] this = [object Object] 5 anonymous(1) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":333] this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
Attached patch fixSplinter Review
The assert might be bogus, but really the tracer should stop here.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #485359 - Flags: review?(wmccloskey)
Comment on attachment 485359 [details] [diff] [review] fix Seems good to me.
Attachment #485359 - Flags: review?(wmccloskey) → review+
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Depends on: 596730
No longer depends on: 596730
Depends on: 611575
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: