Closed
Bug 606083
Opened 12 years ago
Closed 12 years ago
Assertion failure: !TRACE_RECORDER(cx), at js/src/jsinterp.cpp:6932
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: bc, Assigned: dvander)
References
()
Details
(Keywords: crash, Whiteboard: fixed-in-tracemonkey)
Attachments
(2 files)
55.47 KB,
text/plain
|
Details | |
1.05 KB,
patch
|
billm
:
review+
|
Details | Diff | Splinter Review |
mozilla central 4da5ab8255ec tip 32bit vista only so far. 1. <http://maps.google.de/maps?f=q%26source=s_q%26output=js%26hl=de%26geocode=%26abauth=4cb403338--OrcajRquW5QccXAx3b6HxvTo%26q=Wilderich-Lang-Strasse%2B4%26btnG=Maps-Suche%26vps=2%26jsv=284c%26sll=48.148203%252C11.535789%26sspn=0.007473%252C0.018947%26gl=de%26g=Wilderich-Lang-Strasse%2B4> 2. Assertion failure: !TRACE_RECORDER(cx), at c:/work/mozilla/builds/2.0.0/mozilla/js/src/jsinterp.cpp:6932 chofmann, laura: re bug 579136, this crash generated 6 dump identical dump files.
Comment 1•12 years ago
|
||
bc, good catch. could you figure out if the reports are dup'ed on the client, or is there a single instance of the report there, and just dups on the server?
Reporter | ||
Comment 2•12 years ago
|
||
duped on the client. I generate a crash report for each dmp file found. there were 6 for this crash/assertion.
Reporter | ||
Comment 3•12 years ago
|
||
also windows xp.
Comment 5•12 years ago
|
||
I assume you're only hitting this on debug builds, since it's an assertion failure?
Reporter | ||
Comment 6•12 years ago
|
||
y
Comment 7•12 years ago
|
||
I grabbed a debug build from tinderbox-builds, ran it locally (Win7 x64), loaded that URL and hit the assertion. I only wound up with one minidump, though.
Comment 8•12 years ago
|
||
Bob, do you always get six?
Comment 9•12 years ago
|
||
(gdb) bt #0 0x00000037ed40efbb in raise () from /lib64/libpthread.so.0 #1 0x00007ffff6a9e9d8 in JS_Assert (s=0x7ffff73484c7 "!TRACE_RECORDER(cx)", file=0x7ffff73482d8 "../../../mozilla/js/src/jsinterp.cpp", ln=6932) at ../../../mozilla/js/src/jsutil.cpp:83 #2 0x00007ffff6c065dd in js::Interpret (cx=0x7fffe0ff2000, entryFrame= 0x7fffe8bfd318, inlineCallCount=0, interpMode=JSINTERP_RECORD) at ../../../mozilla/js/src/jsinterp.cpp:6932 #3 0x00007ffff6af7596 in js::MonitorTracePoint (cx=0x7fffe0ff2000, inlineCallCount=@0x7fffffffa610, blacklist=@0x7fffffffa617) at ../../../mozilla/js/src/jstracer.cpp:16731 #4 0x00007ffff6b8de03 in RunTracer (f=..., tic=...) at ../../../mozilla/js/src/methodjit/InvokeHelpers.cpp:944 #5 0x00007ffff6b8e0f2 in js::mjit::stubs::InvokeTracer (f=..., tic= 0x7fffc8e98d88) at ../../../mozilla/js/src/methodjit/InvokeHelpers.cpp:1034 #6 0x00007fffcbc3e9bd in ?? () #7 0x00007fffc90bb568 in ?? () #8 0x0000000000000001 in ?? () #9 0x00007fffffffa6f0 in ?? () #10 0x00007fffffffaa90 in ?? () #11 0x00007fffffffa73c in ?? () #12 0x00007fffe8bfd418 in ?? () #13 0x00007fffc8911829 in ?? () #14 0x00007fffe8bfd3b8 in ?? () #15 0x00007fffe0ff2000 in ?? () #16 0x00007fffe8ca71b0 in ?? () #17 0x00007fffe8bfd288 in ?? () #18 0x00007fffe8bfd288 in ?? () #19 0xfffbffffdd887500 in ?? () #20 0x00007fffffffffff in ?? () #21 0xffff800000000000 in ?? () #22 0x0000000000002000 in ?? () #23 0x00007fffffffa780 in ?? () #24 0x00007ffff6b396df in js::mjit::EnterMethodJIT (cx=0x7fffe8bfd418, fp= 0x7fffffffa73c, code=0x7fffffffaa90, stackLimit=0x7fffffffa6f0) at ../../../mozilla/js/src/methodjit/MethodJIT.cpp:742 Backtrace stopped: frame did not save the PC
Comment 10•12 years ago
|
||
JS stack: (gdb) call DumpJSStack() [Thread 0x7fffdedfe710 (LWP 1508) exited] [Thread 0x7fffd06ff710 (LWP 1008) exited] [Thread 0x7fffc88fe710 (LWP 1024) exited] [Thread 0x7fffcbaff710 (LWP 1020) exited] [Thread 0x7fffcc6ff710 (LWP 1019) exited] 0 Nk(c = undefined, b = [object HTMLHeadElement @ 0x7fffdd8d23c0 (native @ 0x7fffd0a93d40)], a = "lcs_c") ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":782] j = "lt_c" g = [object HTMLStyleElement @ 0x7fffc585b4b0 (native @ 0x7fffc6afcce0)] f = 4 e = [object HTMLCollection @ 0x7fffdd8d2438 (native @ 0x7fffcc8a4600)] d = [object HTMLStyleElement @ 0x7fffc585d1e0 (native @ 0x7fffcdc62840)] this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)] 1 anonymous([object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":495] b = "GAddMessages({});X("lcs_c",Pc,q);X("lcs_c");" a = "lcs_c" this = [object Object] 2 anonymous([object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":19] this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)] 3 anonymous(a = [object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":468] d = 1287769942135 c = [function] b = [function] this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)] 4 anonymous() ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":470] this = [object Object] 5 anonymous(1) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":333] this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
![]() |
Assignee | |
Comment 11•12 years ago
|
||
The assert might be bogus, but really the tracer should stop here.
Comment on attachment 485359 [details] [diff] [review] fix Seems good to me.
Attachment #485359 -
Flags: review?(wmccloskey) → review+
![]() |
Assignee | |
Comment 13•12 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/0aa283c6294f
Whiteboard: fixed-in-tracemonkey
Comment 14•12 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/0aa283c6294f
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•