David Baron :dbaron: Reporter
	Description • 15 years ago

Running a reasonably current x86-64 Linux mozilla-central debug build:

Steps to reproduce:
  1. load:
http://graphs.mozilla.org/graph.html#type=series&tests=[{%22test%22:22,%22branch%22:1,%22machine%22:204,%22testrun%22:3038142}]
  2. wait for the graph to load
  3. move the mouse over the graph

I get a JS_ASSERT failure (at the end of a sequence of JavaScript errors):
Assertion failure: oldInlineCallCount == inlineCallCount, at /home/dbaron/builds/mozilla-central/mozilla/js/src/jstracer.cpp:6170



(gdb) f 6
#6  0x00007f29450f3191 in TraceRecorder::attemptTreeCall (this=0x182b7620, 
    f=0x19a6e768, inlineCallCount=@0x7fff525f085c)
    at /home/dbaron/builds/mozilla-central/mozilla/js/src/jstracer.cpp:6170
6170	        JS_ASSERT(oldInlineCallCount == inlineCallCount);
Current language:  auto
The current source language is "auto; currently c++".
(gdb) p oldInlineCallCount
$2 = 4
(gdb) p inlineCallCount
$3 = (uintN &) @0x7fff525f085c: 3
(gdb) p cx->fp->script
$4 = (JSScript *) 0x1764baa0
(gdb) p *$
$5 = {code = 0x1764bb2c "\344T", length = 257, version = 8192, nfixed = 5, 
  objectsOffset = 0 '\000', upvarsOffset = 88 'X', regexpsOffset = 0 '\000', 
  trynotesOffset = 0 '\000', noScriptRval = false, savedCallerFun = false, 
  hasSharps = false, strictModeCode = false, main = 0x1764bb2c "\344T", 
  atomMap = {vector = 0x1764bb08, length = 4}, 
  filename = 0xf5e979d "http://graphs.mozilla.org/js/DataSet.js", lineno = 78, 
  nslots = 14, staticLevel = 2, principals = 0x18d40ed8, u = {object = 0x0, 
    nextToGC = 0x0}, owner = 0x0, static emptyScriptConst = {
    code = 0x7f2945134112  <incomplete sequence \303>, length = 1, 
    version = 0, nfixed = 0, objectsOffset = 0 '\000', 
    upvarsOffset = 0 '\000', regexpsOffset = 0 '\000', 
    trynotesOffset = 0 '\000', noScriptRval = true, savedCallerFun = false, 
    hasSharps = false, strictModeCode = false, 
    main = 0x7f2945134112  <incomplete sequence \303>, atomMap = {
      vector = 0x0, length = 0}, filename = 0x0, lineno = 0, nslots = 0, 
    staticLevel = 0, principals = 0x0, u = {object = 0x0, nextToGC = 0x0}, 
    owner = 0x0, 
    static emptyScriptConst = <same as static member of an already seen type>}}
(gdb) p *tree
$6 = {<LinkableFragment> = {<VMFragment> = {<nanojit::Fragment> = {
        lirbuf = 0x19035838, lastIns = 0x0, ip = 0x1764bb2c, 
        recordAttempts = 1, fragEntry = 0x0, loopLabel = 0x0, profFragID = 0, 
        profCount = 0, nStaticExits = 0, nCodeBytes = 0, nExitBytes = 0, 
        guardNumberer = 6, guardsForFrag = 0x18fc42a0, _code = 0x0, 
        _hits = 2}, root = 0x19a6e5e0}, branchCount = 0, 
    typeMap = {<Queue<JSTraceType_>> = {_data = 0x17aa6910, _len = 16, 
        _max = 32, alloc = 0x7f2934b64010}, <No data fields>}, 
    nStackTypes = 12, globalSlots = 0x1aa2fb08}, first = 0x19a6e5e0, 
  next = 0x0, peer = 0x0, globalObj = 0x7f29289d9cc0, globalShape = 9751528, 
  argc = 4, dependentTrees = {_data = 0x0, _len = 0, _max = 0, 
    alloc = 0x7f2934b64010}, linkedTrees = {_data = 0x0, _len = 0, _max = 0, 
    alloc = 0x7f2934b64010}, 
  treeFileName = 0xf5e979d "http://graphs.mozilla.org/js/DataSet.js", 
  treeLineNumber = 78, treePCOffset = 0, script = 0x1764baa0, 
  recursion = Recursion_None, unstableExits = 0x0, sideExits = {_data = 0x0, 
    _len = 0, _max = 0, alloc = 0x7f2934b64010}, nativeStackBase = 96, 
  maxCallDepth = 0, gcthings = {_data = 0x0, _len = 0, _max = 0, 
    alloc = 0x7f2934b64010}, sprops = {_data = 0x0, _len = 0, _max = 0, 
    alloc = 0x7f2934b64010}, maxNativeStackSlots = 15}
(gdb) p callDepth
$7 = 0

	David Anderson [:dvander] - inactive, e-mail if emergency
	Comment 2 • 15 years ago

I think this is fixed by bug 530988, but I can't test it yet because graphs.mozilla.org does not load for me.

	David Anderson [:dvander] - inactive, e-mail if emergency
	Comment 3 • 15 years ago

With the graph server back up, I can still reproduce the problem, and the aforementioned bug indeed fixes it.