606083 - Assertion failure: !TRACE_RECORDER(cx), at js/src/jsinterp.cpp:6932

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: stack

mozilla central 4da5ab8255ec tip 32bit vista only so far.

1. <http://maps.google.de/maps?f=q%26source=s_q%26output=js%26hl=de%26geocode=%26abauth=4cb403338--OrcajRquW5QccXAx3b6HxvTo%26q=Wilderich-Lang-Strasse%2B4%26btnG=Maps-Suche%26vps=2%26jsv=284c%26sll=48.148203%252C11.535789%26sspn=0.007473%252C0.018947%26gl=de%26g=Wilderich-Lang-Strasse%2B4>
2. Assertion failure: !TRACE_RECORDER(cx), at c:/work/mozilla/builds/2.0.0/mozilla/js/src/jsinterp.cpp:6932

chofmann, laura: re bug 579136, this crash generated 6 dump identical dump files.

Comment 1

[chris hofmann]

bc, good catch.  could you figure out if the reports are dup'ed on the client, or is there a single instance of the report there, and just dups on the server?

Comment 2

[Bob Clary [:bc] (inactive)]

duped on the client. I generate a crash report for each dmp file found. there were 6 for this crash/assertion.

Comment 3

[Bob Clary [:bc] (inactive)]

also windows xp.

Comment 4

[Bob Clary [:bc] (inactive)]

and linux.

Comment 5

[(not currently active) Ted Mielczarek]

I assume you're only hitting this on debug builds, since it's an assertion failure?

Comment 6

[Bob Clary [:bc] (inactive)]

y

Comment 7

[(not currently active) Ted Mielczarek]

I grabbed a debug build from tinderbox-builds, ran it locally (Win7 x64), loaded that URL and hit the assertion. I only wound up with one minidump, though.

Comment 8

[Laura Thomson :laura]

Bob, do you always get six?

Comment 9

[Johnny Stenback (:jst)]

(gdb) bt
#0  0x00000037ed40efbb in raise () from /lib64/libpthread.so.0
#1  0x00007ffff6a9e9d8 in JS_Assert (s=0x7ffff73484c7 "!TRACE_RECORDER(cx)", 
    file=0x7ffff73482d8 "../../../mozilla/js/src/jsinterp.cpp", ln=6932)
    at ../../../mozilla/js/src/jsutil.cpp:83
#2  0x00007ffff6c065dd in js::Interpret (cx=0x7fffe0ff2000, entryFrame=
    0x7fffe8bfd318, inlineCallCount=0, interpMode=JSINTERP_RECORD)
    at ../../../mozilla/js/src/jsinterp.cpp:6932
#3  0x00007ffff6af7596 in js::MonitorTracePoint (cx=0x7fffe0ff2000, 
    inlineCallCount=@0x7fffffffa610, blacklist=@0x7fffffffa617)
    at ../../../mozilla/js/src/jstracer.cpp:16731
#4  0x00007ffff6b8de03 in RunTracer (f=..., tic=...)
    at ../../../mozilla/js/src/methodjit/InvokeHelpers.cpp:944
#5  0x00007ffff6b8e0f2 in js::mjit::stubs::InvokeTracer (f=..., tic=
    0x7fffc8e98d88) at ../../../mozilla/js/src/methodjit/InvokeHelpers.cpp:1034
#6  0x00007fffcbc3e9bd in ?? ()
#7  0x00007fffc90bb568 in ?? ()
#8  0x0000000000000001 in ?? ()
#9  0x00007fffffffa6f0 in ?? ()
#10 0x00007fffffffaa90 in ?? ()
#11 0x00007fffffffa73c in ?? ()
#12 0x00007fffe8bfd418 in ?? ()
#13 0x00007fffc8911829 in ?? ()
#14 0x00007fffe8bfd3b8 in ?? ()
#15 0x00007fffe0ff2000 in ?? ()
#16 0x00007fffe8ca71b0 in ?? ()
#17 0x00007fffe8bfd288 in ?? ()
#18 0x00007fffe8bfd288 in ?? ()
#19 0xfffbffffdd887500 in ?? ()
#20 0x00007fffffffffff in ?? ()
#21 0xffff800000000000 in ?? ()
#22 0x0000000000002000 in ?? ()
#23 0x00007fffffffa780 in ?? ()
#24 0x00007ffff6b396df in js::mjit::EnterMethodJIT (cx=0x7fffe8bfd418, fp=
    0x7fffffffa73c, code=0x7fffffffaa90, stackLimit=0x7fffffffa6f0)
    at ../../../mozilla/js/src/methodjit/MethodJIT.cpp:742
Backtrace stopped: frame did not save the PC

Comment 10

[Johnny Stenback (:jst)]

JS stack:

(gdb) call DumpJSStack()
[Thread 0x7fffdedfe710 (LWP 1508) exited]
[Thread 0x7fffd06ff710 (LWP 1008) exited]
[Thread 0x7fffc88fe710 (LWP 1024) exited]
[Thread 0x7fffcbaff710 (LWP 1020) exited]
[Thread 0x7fffcc6ff710 (LWP 1019) exited]
0 Nk(c = undefined, b = [object HTMLHeadElement @ 0x7fffdd8d23c0 (native @ 0x7fffd0a93d40)], a = "lcs_c") ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":782]
    j = "lt_c"
    g = [object HTMLStyleElement @ 0x7fffc585b4b0 (native @ 0x7fffc6afcce0)]
    f = 4
    e = [object HTMLCollection @ 0x7fffdd8d2438 (native @ 0x7fffcc8a4600)]
    d = [object HTMLStyleElement @ 0x7fffc585d1e0 (native @ 0x7fffcdc62840)]
    this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
1 anonymous([object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":495]
    b = "GAddMessages({});X("lcs_c",Pc,q);X("lcs_c");"
    a = "lcs_c"
    this = [object Object]
2 anonymous([object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":19]
    this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
3 anonymous(a = [object Object]) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":468]
    d = 1287769942135
    c = [function]
    b = [function]
    this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]
4 anonymous() ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":470]
    this = [object Object]
5 anonymous(1) ["http://maps.gstatic.com/intl/en_us/mapfiles/286b/maps2/main.js":333]
    this = [object Window @ 0x7fffd512e940 (native @ 0x7fffd8ce5470)]

Comment 11

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

The assert might be bogus, but really the tracer should stop here.

Comment 12

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 485359 [details] [diff] [review]
fix

Seems good to me.

Comment 13

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/0aa283c6294f

Comment 14

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/0aa283c6294f