913263 - DumpJSStack asserts "Assertion failure: v.isObject()"

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect)

Description

[Cameron McCormack (:heycam)]

I asked on IRC if there was a way to get gdb to show me JS location / line numbers when I do a backtrace, and was suggested to use DumpJSStack.  I tried this and got an assertion:

(gdb) bt
#0  nsComputedDOMStyle::GetPropertyCSSValue (this=0x126b3bdd0, aPropertyName=@0x7fff5fbfa950, aRv=@0x7fff5fbfa828) at ../../../layout/style/nsComputedDOMStyle.cpp:581
#1  0x000000010200fda9 in nsComputedDOMStyle::GetPropertyValue (this=0x126b3bdd0, aPropertyName=@0x7fff5fbfa950, aReturn=@0x7fff5fbfa8f8) at ../../../layout/style/nsComputedDOMStyle.cpp:264
#2  0x0000000103ec3183 in nsICSSDeclaration::GetPropertyValue (this=0x126b3bdd0, aPropName=@0x7fff5fbfa950, aValue=@0x7fff5fbfa8f8, rv=@0x7fff5fbfa920) at nsICSSDeclaration.h:126
#3  0x0000000103ec19ce in mozilla::dom::CSSStyleDeclarationBinding::getPropertyValue (cx=0x116528080, obj={<js::HandleBase<JSObject *>> = {<No data fields>}, ptr = 0x7fff5fbfaa48}, self=0x126b3bdd0, args=@0x7fff5fbfa9e8) at CSSStyleDeclarationBinding.cpp:139
#4  0x0000000103ec084d in mozilla::dom::CSSStyleDeclarationBinding::genericMethod (cx=0x116528080, argc=1, vp=0x7fff5fbfaad8) at CSSStyleDeclarationBinding.cpp:373
#5  0x0000000153d530fe in ?? ()
(gdb) call DumpJSStack()
Assertion failure: v.isObject(), at ../../../js/src/jit/IonFrameIterator.h:474

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
js::jit::InlineFrameIteratorMaybeGC<(js::AllowGC)1>::thisObject (this=0x7fff5fbfa268) at IonFrameIterator.h:474
474	        JS_ASSERT(v.isObject());

Comment 1

[Cameron McCormack (:heycam)]

Using js_DumpStack worked though:

(gdb) bt
#0  nsComputedDOMStyle::GetPropertyCSSValue (this=0x116ffceb0, aPropertyName=@0x7fff5fbfa950, aRv=@0x7fff5fbfa828) at ../../../layout/style/nsComputedDOMStyle.cpp:581
#1  0x000000010200fda9 in nsComputedDOMStyle::GetPropertyValue (this=0x116ffceb0, aPropertyName=@0x7fff5fbfa950, aReturn=@0x7fff5fbfa8f8) at ../../../layout/style/nsComputedDOMStyle.cpp:264
#2  0x0000000103ec3183 in nsICSSDeclaration::GetPropertyValue (this=0x116ffceb0, aPropName=@0x7fff5fbfa950, aValue=@0x7fff5fbfa8f8, rv=@0x7fff5fbfa920) at nsICSSDeclaration.h:126
#3  0x0000000103ec19ce in mozilla::dom::CSSStyleDeclarationBinding::getPropertyValue (cx=0x116b4eec0, obj={<js::HandleBase<JSObject *>> = {<No data fields>}, ptr = 0x7fff5fbfaa48}, self=0x116ffceb0, args=@0x7fff5fbfa9e8) at CSSStyleDeclarationBinding.cpp:139
#4  0x0000000103ec084d in mozilla::dom::CSSStyleDeclarationBinding::genericMethod (cx=0x116b4eec0, argc=1, vp=0x7fff5fbfaad8) at CSSStyleDeclarationBinding.cpp:373
#5  0x0000000123f480fe in ?? ()
(gdb) call js_DumpBacktrace(0x116b4eec0)
#0            0x0   http://mochi.test:8888/tests/layout/style/test/test_value_storage.html?autorun=1&closeWhenDone=1&consoleLevel=INFO&failureFile=/z/moz/b/obj-mac-dbg/.mozbuild/mochitest_failures.json:139 (0x117a2fdc0 @ 338)
#1            0x0   http://mochi.test:8888/tests/layout/style/test/test_value_storage.html?autorun=1&closeWhenDone=1&consoleLevel=INFO&failureFile=/z/moz/b/obj-mac-dbg/.mozbuild/mochitest_failures.json:263 (0x117a2fd00 @ 17)
#2            0x0   http://mochi.test:8888/tests/layout/style/test/test_value_storage.html?autorun=1&closeWhenDone=1&consoleLevel=INFO&failureFile=/z/moz/b/obj-mac-dbg/.mozbuild/mochitest_failures.json:281 (0x117a2fc40 @ 252)
#3            0x0   http://mochi.test:8888/tests/layout/style/test/test_value_storage.html?autorun=1&closeWhenDone=1&consoleLevel=INFO&failureFile=/z/moz/b/obj-mac-dbg/.mozbuild/mochitest_failures.json:309 (0x117a2fb80 @ 60)