Closed Bug 737447 Opened 12 years ago Closed 12 years ago

Assertion failure: v.isBoolean() | Crash [@ js_ValueToBoolean ]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 737388

People

(Reporter: bc, Unassigned)

References

(
URL
)

Details

(Keywords: assertion, crash, regression)

Crash Data

1. http://www.dhl.com/en/express/shipping/get_rate_and_time_quote.html
2. Assertion failure: v.isBoolean(), at /work/mozilla/builds/nightly/mozilla/js/src/jsbool.cpp:233

or Crash nightly Nightly :-)

bp-4e110b58-ceab-4875-a622-cc58e2120320
bp-d8c3d343-b597-4c82-b90e-172a92120320

These don't seem to have been reported to Socorro though.... :-(

Operating system: Windows NT
                  6.1.7601 Service Pack 1
CPU: x86
     GenuineIntel family 6 model 37 stepping 1
     1 CPU

Crash reason:  EXCEPTION_ACCESS_VIOLATION_WRITE
Crash address: 0x0

Thread 0 (crashed)
 0  mozglue.dll!MOZ_Crash [Assertions.cpp : 69 + 0x0]
    eip = 0x70a41073   esp = 0x002addd4   ebp = 0x002addd4   ebx = 0x08266a90
    esi = 0x0000000b   edi = 0xffffff84   eax = 0x00000000   ecx = 0xb92d154c
    edx = 0x6f2a1d48   efl = 0x00010202
    Found by: given as instruction pointer in context
 1  mozglue.dll!MOZ_Assert [Assertions.cpp : 88 + 0x4]
    eip = 0x70a410cf   esp = 0x002adddc   ebp = 0x002adddc
    Found by: call frame info
 2  mozjs.dll!js_ValueToBoolean(JS::Value const &) [jsbool.cpp : 233 + 0x25]
    eip = 0x6ad76316   esp = 0x002adde4   ebp = 0x002addfc
    Found by: call frame info
 3  mozjs.dll!js::Interpret(JSContext *,js::StackFrame *,js::InterpMode) [jsinterp.cpp : 1915 + 0x57]
    eip = 0x6ae0200d   esp = 0x002ade04   ebp = 0x002ae6f8
    Found by: call frame info
 4  mozjs.dll!js::mjit::EnterMethodJIT(JSContext *,js::StackFrame *,void *,JS::Value *,bool) [MethodJIT.cpp : 1079 + 0x10]
    eip = 0x6af918b2   esp = 0x002ae700   ebp = 0x002ae750
    Found by: call frame info

Nightly/14 All Platforms. Doesn't reproduce with a downloaded copy. Get it while you can.
Looks like the crash movers (the thing that takes the collected crashes and puts them in HBase, ready for processing) are way behind because of network issues.  Lars filed bug 737485.  Hopefully this will resolve the problem.
Depends on: 737485
Crash Signature: [@ js_ValueToBoolean ]
Summary: Assertion failure: v.isBoolean(), → Assertion failure: v.isBoolean() | Crash [@ js_ValueToBoolean ]
Blocks: 736815
bisection (if i did it right) says http://hg.mozilla.org/mozilla-central/rev/d2107141265f

The summary says Bug 730497. Is that right?
Depends on: 730497
Fortunately, this is a dup of a fuzzbug from yesterday.  (Also, this isn't caused by bug 730497; the cset summary has the wrong bug # (it was relanded a few csets later with the right bug #).)
Status: NEW → RESOLVED
Closed: 12 years ago
No longer depends on: 730497
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.