Closed Bug 606083 Opened 12 years ago Closed 12 years ago

Assertion failure: !TRACE_RECORDER(cx), at js/src/jsinterp.cpp:6932

Categories

(Core :: JavaScript Engine, defect)

x86
All
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: bc, Assigned: dvander)

References

()

Details

(Keywords: crash, Whiteboard: fixed-in-tracemonkey)

Attachments

(2 files)

Attached file stack
mozilla central 4da5ab8255ec tip 32bit vista only so far.

1. <http://maps.google.de/maps?f=q%26source=s_q%26output=js%26hl=de%26geocode=%26abauth=4cb403338--OrcajRquW5QccXAx3b6HxvTo%26q=Wilderich-Lang-Strasse%2B4%26btnG=Maps-Suche%26vps=2%26jsv=284c%26sll=48.148203%252C11.535789%26sspn=0.007473%252C0.018947%26gl=de%26g=Wilderich-Lang-Strasse%2B4>
2. Assertion failure: !TRACE_RECORDER(cx), at c:/work/mozilla/builds/2.0.0/mozilla/js/src/jsinterp.cpp:6932

chofmann, laura: re bug 579136, this crash generated 6 dump identical dump files.
Depends on: 579136
bc, good catch.  could you figure out if the reports are dup'ed on the client, or is there a single instance of the report there, and just dups on the server?
duped on the client. I generate a crash report for each dmp file found. there were 6 for this crash/assertion.
also windows xp.
and linux.
OS: Windows Vista → All
I assume you're only hitting this on debug builds, since it's an assertion failure?
y
I grabbed a debug build from tinderbox-builds, ran it locally (Win7 x64), loaded that URL and hit the assertion. I only wound up with one minidump, though.
Bob, do you always get six?
(gdb) bt
#0  0x00000037ed40efbb in raise () from /lib64/libpthread.so.0
#1  0x00007ffff6a9e9d8 in JS_Assert (s=0x7ffff73484c7 "!TRACE_RECORDER(cx)", 
    file=0x7ffff73482d8 "../../../mozilla/js/src/jsinterp.cpp", ln=6932)
    at ../../../mozilla/js/src/jsutil.cpp:83
#2  0x00007ffff6c065dd in js::Interpret (cx=0x7fffe0ff2000, entryFrame=
    0x7fffe8bfd318, inlineCallCount=0, interpMode=JSINTERP_RECORD)
    at ../../../mozilla/js/src/jsinterp.cpp:6932
#3  0x00007ffff6af7596 in js::MonitorTracePoint (cx=0x7fffe0ff2000, 
    inlineCallCount=@0x7fffffffa610, blacklist=@0x7fffffffa617)
    at ../../../mozilla/js/src/jstracer.cpp:16731
#4  0x00007ffff6b8de03 in RunTracer (f=..., tic=...)
    at ../../../mozilla/js/src/methodjit/InvokeHelpers.cpp:944
#5  0x00007ffff6b8e0f2 in js::mjit::stubs::InvokeTracer (f=..., tic=
    0x7fffc8e98d88) at ../../../mozilla/js/src/methodjit/InvokeHelpers.cpp:1034
#6  0x00007fffcbc3e9bd in ?? ()
#7  0x00007fffc90bb568 in ?? ()
#8  0x0000000000000001 in ?? ()
#9  0x00007fffffffa6f0 in ?? ()
#10 0x00007fffffffaa90 in ?? ()
#11 0x00007fffffffa73c in ?? ()
#12 0x00007fffe8bfd418 in ?? ()
#13 0x00007fffc8911829 in ?? ()
#14 0x00007fffe8bfd3b8 in ?? ()
#15 0x00007fffe0ff2000 in ?? ()
#16 0x00007fffe8ca71b0 in ?? ()
#17 0x00007fffe8bfd288 in ?? ()
#18 0x00007fffe8bfd288 in ?? ()
#19 0xfffbffffdd887500 in ?? ()
#20 0x00007fffffffffff in ?? ()
#21 0xffff800000000000 in ?? ()
#22 0x0000000000002000 in ?? ()
#23 0x00007fffffffa780 in ?? ()
#24 0x00007ffff6b396df in js::mjit::EnterMethodJIT (cx=0x7fffe8bfd418, fp=
    0x7fffffffa73c, code=0x7fffffffaa90, stackLimit=0x7fffffffa6f0)
    at ../../../mozilla/js/src/methodjit/MethodJIT.cpp:742
Backtrace stopped: frame did not save the PC
JS stack:

(gdb) call DumpJSStack()
[Thread 0x7fffdedfe710 (LWP 1508) exited]
[Thread 0x7fffd06ff710 (LWP 1008) exited]
[Thread 0x7fffc88fe710 (LWP 1024) exited]
[Thread 0x7fffcbaff710 (LWP 1020) exited]
[Thread 0x7fffcc6ff710 (LWP 1019) exited]
0 Nk(c = undefined, b = [object HTMLHeadElement @ 0x7fffdd8d23c0 (native @ 0x7fffd0a93d40)], a = "lcs_c") ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":782]
    j = "lt_c"
    g = [object HTMLStyleElement @ 0x7fffc585b4b0 (native @ 0x7fffc6afcce0)]
    f = 4
    e = [object HTMLCollection @ 0x7fffdd8d2438 (native @ 0x7fffcc8a4600)]
    d = [object HTMLStyleElement @ 0x7fffc585d1e0 (native @ 0x7fffcdc62840)]
    this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
1 anonymous([object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":495]
    b = "GAddMessages({});X("lcs_c",Pc,q);X("lcs_c");"
    a = "lcs_c"
    this = [object Object]
2 anonymous([object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":19]
    this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
3 anonymous(a = [object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":468]
    d = 1287769942135
    c = [function]
    b = [function]
    this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
4 anonymous() ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":470]
    this = [object Object]
5 anonymous(1) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":333]
    this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
Attached patch fixSplinter Review
The assert might be bogus, but really the tracer should stop here.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #485359 - Flags: review?(wmccloskey)
Comment on attachment 485359 [details] [diff] [review]
fix

Seems good to me.
Attachment #485359 - Flags: review?(wmccloskey) → review+
http://hg.mozilla.org/mozilla-central/rev/0aa283c6294f
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Depends on: 596730
No longer depends on: 596730
Depends on: 611575
You need to log in before you can comment on or make changes to this bug.