808322 - Assertion failure: stack_[*size_].script() == script on switch between private mode

Status: RESOLVED INACTIVE

(Core :: JavaScript Engine, defect)

Description

[Oleg Romashin (:romaxa)]

Nightly crashes always on attempt to switch between private and normal mode.

WARNING: NS_ENSURE_TRUE(mMutable) failed: file netwerk/base/src/nsSimpleURI.cpp, line 272
JavaScript strict warning: chrome://global/content/bindings/tabbox.xml, line 390: reference to undefined property tab.value
MOZ_EVENT_TRACE sample 1351979343417 1392
WARNING: NS_ENSURE_SUCCESS(rv, false) failed with result 0x8000FFFF: file content/base/src/nsContentUtils.cpp, line 2993
MOZ_EVENT_TRACE sample 1351979343460 43
++DOMWINDOW == 29 (0x38fe210) [serial = 43] [outer = 0x2668c80]
MOZ_EVENT_TRACE sample 1351979343541 80
Assertion failure: stack_[*size_].script() == script, at js/src/vm/SPSProfiler.cpp:129

Backtrace

#0  0x00007f9be16c587d in nanosleep () at ../sysdeps/unix/syscall-template.S:82
#1  0x00007f9be16c56f0 in __sleep (seconds=<optimized out>)
    at ../sysdeps/unix/sysv/linux/sleep.c:138
#2  0x00007f9bdcc91e1a in ah_crap_handler (signum=11)
    at toolkit/xre/nsSigHandlers.cpp:87
#3  0x00007f9bdcc9866e in nsProfileLock::FatalSignalHandler (signo=11, 
    info=<optimized out>, context=<optimized out>)
    at obj-ff-gtk2/toolkit/profile/nsProfileLock.cpp:190
#4  <signal handler called>
#5  0x00007f9bde40f100 in js::SPSProfiler::exit (this=0x7f9bccbc6cb8, 
    cx=<optimized out>, script=0x7f9bba259538, maybeFun=<optimized out>)
    at js/src/vm/SPSProfiler.cpp:129
#6  0x00007f9bde3b03d5 in exitScript (fp=0x7f9bc7c00518, 
    maybeFun=<optimized out>, script=0x7f9bba259538, cx=0x3375e50)
    at js/src/jsprobes.h:368
#7  js::StackFrame::epilogue (this=0x7f9bc7c00518, cx=0x3375e50)
    at js/src/vm/Stack.cpp:326
#8  0x00007f9bde256bb8 in js::Interpret (cx=cx@entry=0x3375e50, 
---Type <return> to continue, or q <return> to quit---
    entryFrame=entryFrame@entry=0x7f9bc7c00518, interpMode=js::JSINTERP_NORMAL)
    at js/src/jsinterp.cpp:3776
#9  0x00007f9bde25a6bf in js::RunScript (cx=0x3375e50, script=..., 
    fp=0x7f9bc7c00518)
    at js/src/jsinterp.cpp:324
#10 0x00007f9bde25d5ba in SendToGenerator (cx=0x3375e50, 
    op=op@entry=JSGENOP_NEXT, gen=gen@entry=0x540be00, arg=..., obj=...)
    at js/src/jsiter.cpp:1574
#11 0x00007f9bde2603bf in generator_next_impl (cx=<optimized out>, args=...)
    at js/src/jsiter.cpp:1681
#12 0x00007f9bde260523 in CallNonGenericMethod<IsGenerator, generator_next_impl> (args=..., cx=<optimized out>)
    at js/src/jsapi.h:1553
#13 generator_next (cx=<optimized out>, argc=0, vp=0x7f9bc7c004e0)
    at js/src/jsiter.cpp:1692
#14 0x00007f9bde247ff4 in js::CallJSNative (cx=0x3375e50, 
    native=0x7f9bde260480 <generator_next(JSContext*, unsigned int, JS::Value*)>---Type <return> to continue, or q <return> to quit---q
Quit
(gdb) frame 5
#5  0x00007f9bde40f100 in js::SPSProfiler::exit (this=0x7f9bccbc6cb8, 
    cx=<optimized out>, script=0x7f9bba259538, maybeFun=<optimized out>)
    at js/src/vm/SPSProfiler.cpp:129
129	        JS_ASSERT(stack_[*size_].script() == script);
(gdb) ^CQuit
(gdb) q
A debugging session is active.

	Inferior 1 [process 32542] will be detached.

Quit anyway? (y or n) n
Not confirmed.
(gdb) p script
$1 = (JSScript *) 0x7f9bba259538
(gdb) p *script
$2 = {<js::gc::Cell> = {static CellShift = 3, static CellSize = 8, 
    static CellMask = 7}, static stepFlagMask = 2147483648, 
  static stepCountMask = 2147483647, bindings = {
    callObjShape_ = {<js::EncapsulatedPtr<js::Shape, unsigned long>> = {{
          value = 0x7f9bba25a3d0, 
          other = 140306819687376}}, <No data fields>}, 
    bindingArrayAndFlag_ = 90473044, numArgs_ = 3, numVars_ = 3, 
    static TEMPORARY_STORAGE_BIT = 1}, code = 0x5648284 "\tW", 
  data = 0x56481d0 "@\202d\005", 
  filename = 0x5643ff1 "resource://jid0-edalmuivkozlouyij0lpdx548bc-at-jetpack/api-utils/lib/loader.js -> resource://jid0-edalmuivkozlouyij0lpdx548bc-at-jetpack/api-utils/lib/event/core.js", atoms = 0x56481f0, principals = 0x235b688, 
  originPrincipals = 0x235b688, types = 0x4c24070, scriptSource_ = 0x5641b50, 
  mJITInfo = 0x0, 
  function_ = {<js::EncapsulatedPtr<JSFunction, unsigned long>> = {{
        value = 0x7f9bba258f00, other = 140306819682048}}, <No data fields>}, 
  enclosingScope_ = {<js::EncapsulatedPtr<JSObject, unsigned long>> = {{
        value = 0x0, other = 0}}, <No data fields>}, length = 255, 
  lineno = 92, mainOffset = 6, natoms = 10, sourceStart = 3204, 
  sourceEnd = 3763, useCount = 7, maxLoopCount = 1, loopCount = 0, id_ = 0, 
  idpad = 0, PADDING = 0, version = 4281, ndefaults = 0, nfixed = 3, 
  nTypeSets = 20, nslots = 9, staticLevel = 1, hasArrayBits = 10 '\n', 
  noScriptRval = false, savedCallerFun = false, strictModeCode = true, 
---Type <return> to continue, or q <return> to quit---
  explicitUseStrict = false, compileAndGo = false, 
  bindingsAccessedDynamically = false, funHasExtensibleScope = false, 
  funHasAnyAliasedFormal = false, warnedAboutTwoArgumentEval = false, 
  warnedAboutUndefinedProp = false, hasSingletons = false, 
  isActiveEval = false, isCachedEval = false, uninlineable = true, 
  debugMode = false, failedBoundsCheck = false, failedShapeGuard = false, 
  invalidatedIdempotentCache = false, isGenerator = true, 
  isGeneratorExp = false, hasScriptCounts = false, hasDebugScript = false, 
  hasFreezeConstraints = false, userBit = false, argsHasVarBinding_ = true, 
  needsArgsAnalysis_ = false, needsArgsObj_ = true, ion = 0x0}
(gdb) p stack_[*size_].script()
[Thread 0x7f9bb1bf5700 (LWP 32614) exited]
[Thread 0x7f9bb0bda700 (LWP 32638) exited]
[Thread 0x7f9bb23f6700 (LWP 32611) exited]

Program received signal SIGINT, Interrupt.
[Switching to Thread 0x7f9bcf4cd700 (LWP 32552)]
syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:39
39	../sysdeps/unix/sysv/linux/x86_64/syscall.S: No such file or directory.
The program received a signal in another thread while
making a function call from GDB.
Evaluation of the expression containing the function
(js::ProfileEntry::script() volatile) will be abandoned.
When the function is done executing, GDB will silently stop.
(gdb) p stack_
No symbol "stack_" in current context.