145493 - Assert in PR_Unlock (called from jsdtoa.c:1681)

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Kalle Valo]

I have a fresh update from CVS trunk and Mozilla doesn't start. This assert is
displayed:

Assertion failure: _PT_PTHREAD_MUTEX_IS_LOCKED(lock->mutex), at ptsynch.c:207

I think the problem is in js/src/jsdtoa.c line 1816. The code comes from bug
#120992 and the patch was committed yesterday. I reverted jsdtoa.c to previous
3.17 revision and Mozilla started without problems.

I use Debian GNU/Linux sid (unstable) with Linux litku 2.4.17 #1 SMP Tue Jan 1
14:52:57 EET 2002 i686 unknown. Note that I have a two processor machine; it
might be of importance when reproducing the bug.

Here's the backtrace:
#0  0x40615781 in kill () from /lib/libc.so.6
#1  0x4034de5e in pthread_kill () from /lib/libpthread.so.0
#2  0x4034e339 in raise () from /lib/libpthread.so.0
#3  0x40616be1 in abort () from /lib/libc.so.6
#4  0x40308ffe in PR_Assert (
    s=0x40337100 "_PT_PTHREAD_MUTEX_IS_LOCKED(lock->mutex)", 
    file=0x40337040 "ptsynch.c", ln=207) at prlog.c:510
#5  0x40322f3f in PR_Unlock (lock=0x8112718) at ptsynch.c:207
#6  0x400b56cd in JS_strtod (s00=0xbfffc33c "", se=0xbfffc32c, err=0xbfffc310)
    at jsdtoa.c:1681
#7  0x400ec1b4 in js_strtod (cx=0x8200538, s=0x848b668, ep=0xbfffc38c, 
    dp=0xbfffcc0c) at jsnum.c:855
#8  0x400eb916 in js_ValueToNumber (cx=0x8200538, v=139795260, dp=0xbfffcc0c)
    at jsnum.c:660
#9  0x400d5d69 in js_Interpret (cx=0x8200538, result=0xbfffcd40)
    at jsinterp.c:2058
#10 0x400d0f80 in js_Invoke (cx=0x8200538, argc=1, flags=2) at jsinterp.c:805
#11 0x400d12ff in js_InternalInvoke (cx=0x8200538, obj=0x8462258, 
    fval=138814064, flags=0, argc=1, argv=0xbfffd7a0, rval=0xbfffd7a0)
    at jsinterp.c:880
#12 0x400f4be3 in js_SetProperty (cx=0x8200538, obj=0x8462258, id=136810728, 
    vp=0xbfffd7a0) at jsobj.c:2604
#13 0x400de25a in js_Interpret (cx=0x8200538, result=0xbfffd890)
    at jsinterp.c:2585
#14 0x400d0f80 in js_Invoke (cx=0x8200538, argc=1, flags=2) at jsinterp.c:805
#15 0x400d12ff in js_InternalInvoke (cx=0x8200538, obj=0x80e5eb8, 
    fval=136865744, flags=0, argc=1, argv=0xbfffdd44, rval=0xbfffda48)
    at jsinterp.c:880
#16 0x4009fa0d in JS_CallFunctionValue (cx=0x8200538, obj=0x80e5eb8, 
    fval=136865744, argc=1, argv=0xbfffdd44, rval=0xbfffda48) at jsapi.c:3424
#17 0x41086c54 in nsJSContext::CallEventHandler (this=0x82004f8, 
    aTarget=0x80e5eb8, aHandler=0x82867d0, argc=1, argv=0xbfffdd44, 
    aBoolResult=0xbfffdb64, aReverseReturnResult=0) at nsJSEnvironment.cpp:1041
#18 0x410ff764 in nsJSEventListener::HandleEvent (this=0x8291b98, 
    aEvent=0x864be90) at nsJSEventListener.cpp:182
#19 0x4132020c in nsEventListenerManager::HandleEventSubType (this=0x8315520, 
    aListenerStruct=0x8320d80, aDOMEvent=0x864be90, aCurrentTarget=0x8200328, 
    aSubType=1, aPhaseFlags=7) at nsEventListenerManager.cpp:1219
#20 0x41322b38 in nsEventListenerManager::HandleEvent (this=0x8315520, 
    aPresContext=0x832ac38, aEvent=0xbfffe434, aDOMEvent=0xbfffe3b0, 
    aCurrentTarget=0x8200328, aFlags=7, aEventStatus=0xbfffe45c)
    at nsEventListenerManager.cpp:1892
#21 0x41098c79 in GlobalWindowImpl::HandleDOMEvent (this=0x8200318, 
    aPresContext=0x832ac38, aEvent=0xbfffe434, aDOMEvent=0xbfffe3b0, aFlags=1, 
    aEventStatus=0xbfffe45c) at nsGlobalWindow.cpp:732
#22 0x41637849 in DocumentViewerImpl::LoadComplete (this=0x8316cf0, aStatus=0)
   at nsDocumentViewer.cpp:1523
#23 0x40fdae1b in nsDocShell::EndPageLoad (this=0x81fff88, 
    aProgress=0x81fdda4, aChannel=0x829cf18, aStatus=0) at nsDocShell.cpp:3959
#24 0x41008a6a in nsWebShell::EndPageLoad (this=0x81fff88, 
    aProgress=0x81fdda4, channel=0x829cf18, aStatus=0) at nsWebShell.cpp:719
#25 0x40fda8d9 in nsDocShell::OnStateChange (this=0x81fff88, 
    aProgress=0x81fdda4, aRequest=0x829cf18, aStateFlags=131088, aStatus=0)
    at nsDocShell.cpp:3874
#26 0x40ee5f7f in nsDocLoaderImpl::FireOnStateChange (this=0x81fdd90, 
    aProgress=0x81fdda4, aRequest=0x829cf18, aStateFlags=131088, aStatus=0)
    at nsDocLoader.cpp:1128
#27 0x40ee526c in nsDocLoaderImpl::doStopDocumentLoad (this=0x81fdd90, 
    request=0x829cf18, aStatus=0) at nsDocLoader.cpp:760
#28 0x40ee4f60 in nsDocLoaderImpl::DocLoaderIsEmpty (this=0x81fdd90)
    at nsDocLoader.cpp:667
#29 0x40ee4c66 in nsDocLoaderImpl::OnStopRequest (this=0x81fdd90, 
    aRequest=0x8599058, aCtxt=0x0, aStatus=0) at nsDocLoader.cpp:597
#30 0x40a36d41 in nsLoadGroup::RemoveRequest (this=0x8200140, 
    request=0x8599058, ctxt=0x0, aStatus=0) at nsLoadGroup.cpp:532
#31 0x40ad13f7 in nsJARChannel::OnStopRequest (this=0x8599058, 
    jarExtractionTransport=0x862a8bc, context=0x0, aStatus=0)
    at nsJARChannel.cpp:610
#32 0x40a411a6 in nsOnStopRequestEvent::HandleEvent (this=0x423004f8)
    at nsRequestObserverProxy.cpp:212
#33 0x40a3ff0d in nsARequestObserverEvent::HandlePLEvent (plev=0x423004f8)
    at nsRequestObserverProxy.cpp:115
#34 0x402470e4 in PL_HandleEvent (self=0x423004f8) at plevent.c:596
#35 0x40246ed0 in PL_ProcessPendingEvents (self=0x80c6ba0) at plevent.c:526
#36 0x402493ce in nsEventQueueImpl::ProcessPendingEvents (this=0x80c6b58)
    at nsEventQueue.cpp:388
#37 0x40be3373 in event_processor_callback (data=0x80c6b58, source=8, 
    condition=GDK_INPUT_READ) at nsAppShell.cpp:184
#38 0x40be2f15 in our_gdk_io_invoke (source=0x829ea08, condition=G_IO_IN, 
    data=0x81c0bc8) at nsAppShell.cpp:77
#39 0x404c6e10 in g_io_add_watch () from /usr/lib/libglib-1.2.so.0
#40 0x404c84d8 in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#41 0x404c8ae3 in g_get_current_time () from /usr/lib/libglib-1.2.so.0
#42 0x404c8c7c in g_main_run () from /usr/lib/libglib-1.2.so.0
#43 0x403ea7f7 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#44 0x40be3986 in nsAppShell::Run (this=0x8110c00) at nsAppShell.cpp:332
#45 0x40b862ba in nsAppShellService::Run (this=0x81336c8)
    at nsAppShellService.cpp:450
#46 0x0805e092 in main1 (argc=3, argv=0xbffff534, nativeApp=0x0)
    at nsAppRunner.cpp:1456
#47 0x0805eedf in main (argc=3, argv=0xbffff534) at nsAppRunner.cpp:1805

Comment 1

[Daniel Bratell]

Ouch. So bad? It's fixed anyway since 15 minutes. The assert is triggered when
someone tries to convert the empty string "" to a decimal. 

Comment 2

[Daniel Bratell]

Well, FIXED.

Comment 3

[Kalle Valo]

Yes, I can confirm that. Revision 3.19 of jsdtoa.c fixes the problem.

Comment 4

[Phil Schwartau]

Marking Verified Fixed per the previous comment -