255727 - Assertion failure: jsdthreadstate->stackDepth > 0, at r:/mozilla/js/jsd/jsd_stak.c:48

Status: VERIFIED DUPLICATE of bug 343511

(Other Applications Graveyard :: Venkman JS Debugger, defect)

Description

[timeless]

js3250.dll!JS_Assert(const char * s=0x017e4430, const char * 
file=0x017e446c, int ln=0x00000030)  Line 155	C
 	jsd3250.dll!JSD_ASSERT_VALID_THREAD_STATE(JSDThreadState * 
jsdthreadstate=0x03be5328)  Line 48 + 0x10	C
 	jsd3250.dll!jsd_DestroyThreadState(JSDContext * jsdc=0x00f94ef8, 
JSDThreadState * jsdthreadstate=0x03be5328)  Line 175 + 0xb	C
>	jsd3250.dll!jsd_NewThreadState(JSDContext * jsdc=0x00f94ef8, JSContext 
* cx=0x012654b0)  Line 151	C
 	jsd3250.dll!jsd_CallExecutionHook(JSDContext * jsdc=0x00f94ef8, 
JSContext * cx=0x012654b0, unsigned int type=0x00000002, unsigned int 
(JSDContext *, JSDThreadState *, unsigned int, void *, long *)* 
hook=0x017e1a85, void * hookData=0x00000000, long * rval=0x0012f180)  Line 165 
+ 0x1b	C
 	jsd3250.dll!jsd_DebugErrorHook(JSContext * cx=0x012654b0, const char * 
message=0x03abd428, JSErrorReport * report=0x0012f1ac, void * 
closure=0x00000000)  Line 365 + 0x16	C
 	js3250.dll!ReportError(JSContext * cx=0x03be5328, const char * 
message=0x03abd428, JSErrorReport * reportp=0x01061e1f)  Line 340 + 0xe	C
 	js3250.dll!js_ReportErrorNumberVA(JSContext * cx=0x012654b0, unsigned 
int flags=0x03abd428, const JSErrorFormatString * (void *, const char *, const 
unsigned int)* callback=0x01061d2f, void * userRef=0x00000000, const unsigned 
int errorNumber=0x00000027, int charArgs=0x00000001, char * ap=0x0012f214)  
Line 632	C
 	js3250.dll!JS_ReportErrorNumber(JSContext * cx=0x012654b0, const 
JSErrorFormatString * (void *, const char *, const unsigned int)* 
errorCallback=0x01061d2f, void * userRef=0x00000000, const unsigned int 
errorNumber=0x00000027, ...)  Line 3983 + 0x19	C
 	js3250.dll!js_ValueToNonNullObject(JSContext * cx=0x012654b0, long 
v=0x00000000)  Line 3717 + 0x18	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0012f38c, long * 
result=0x039dcb95)  Line 3202 + 0x55	C
 	js3250.dll!js_Invoke(JSContext * cx=0x039c84a4, unsigned int 
argc=0x0012f38c, unsigned int flags=0x039dcb95)  Line 1301 + 0xa	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x02e07c68, JSObject * 
obj=0x039b2bf0, long fval=0x039b2ca0, unsigned int flags=0x00000000, unsigned 
int argc=0x00000000, long * argv=0x00000000, long * rval=0x0012f660)  Line 1378 
+ 0xe	C
 	js3250.dll!js_InternalGetOrSet(JSContext * cx=0x012654b0, JSObject * 
obj=0x039b2bf0, long id=0x039cf060, long fval=0x039b2ca0, JSAccessMode 
mode=JSACC_READ, unsigned int argc=0x00000000, long * argv=0x00000000, long * 
rval=0x0012f660)  Line 1421 + 0x19	C
 	js3250.dll!js_GetProperty(JSContext * cx=0x012654b0, JSObject * 
obj=0x039b2bf0, long id=0x039cf060, long * vp=0x0012f660)  Line 2801 + 0x1d
	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0012f38c, long * 
result=0x039dcb95)  Line 3202 + 0xb9	C
 	js3250.dll!js_Invoke(JSContext * cx=0x039c84a4, unsigned int 
argc=0x0012f38c, unsigned int flags=0x039dcb95)  Line 1301 + 0xa	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x02e07c50, JSObject * 
obj=0x039b2bf0, long fval=0x039f5a58, unsigned int flags=0x00000000, unsigned 
int argc=0x00000000, long * argv=0x00000000, long * rval=0x0012f958)  Line 1378 
+ 0xe	C
 	js3250.dll!js_InternalGetOrSet(JSContext * cx=0x012654b0, JSObject * 
obj=0x039b2bf0, long id=0x029c4508, long fval=0x039f5a58, JSAccessMode 
mode=JSACC_READ, unsigned int argc=0x00000000, long * argv=0x00000000, long * 
rval=0x0012f958)  Line 1421 + 0x19	C
 	js3250.dll!js_GetProperty(JSContext * cx=0x012654b0, JSObject * 
obj=0x039b2bf0, long id=0x029c4508, long * vp=0x0012f958)  Line 2801 + 0x1d
	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0012f38c, long * 
result=0x039dcb95)  Line 3202 + 0xb9	C
 	js3250.dll!js_Invoke(JSContext * cx=0x039c84a4, unsigned int 
argc=0x0012f38c, unsigned int flags=0x039dcb95)  Line 1301 + 0xa	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0012f38c, long * 
result=0x039dcb95)  Line 3376	C
 	js3250.dll!js_Invoke(JSContext * cx=0x039c84a4, unsigned int 
argc=0x0012f38c, unsigned int flags=0x039dcb95)  Line 1301 + 0xa	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x012654dc, JSObject * 
obj=0x011e8390, long fval=0x039f6c80, unsigned int flags=0x00000000, unsigned 
int argc=0x00000001, long * argv=0x02fa8ff8, long * rval=0x0012fd90)  Line 1378 
+ 0xe	C
 	js3250.dll!JS_CallFunctionValue(JSContext * cx=0x012654b0, JSObject * 
obj=0x011e8390, long fval=0x039f6c80, unsigned int argc=0x00000001, long * 
argv=0x02fa8ff8, long * rval=0x0012fd90)  Line 3711 + 0x1c	C
 	gklayout.dll!nsJSContext::CallEventHandler(JSObject * 
aTarget=0x011e8390, JSObject * aHandler=0x039f6c80, unsigned int 
argc=0x00000001, long * argv=0x02fa8ff8, long * rval=0x0012fd90)  Line 1345 + 
0x18	C++
 	gklayout.dll!GlobalWindowImpl::RunTimeout(nsTimeoutImpl * 
aTimeout=0x00000000)  Line 5054	C++
 	gklayout.dll!GlobalWindowImpl::TimerCallback(nsITimer * 
aTimer=0x03a1c730, void * aClosure=0x03a1c660)  Line 5413	C++
 	xpcom.dll!nsTimerImpl::Fire()  Line 383 + 0x7	C++
 	xpcom.dll!nsTimerManager::FireNextIdleTimer()  Line 617	C++
 	gkwidget.dll!nsAppShell::Run()  Line 142	C++
 	appshell.dll!nsAppShellService::Run()  Line 489	C++
 	mozilla.exe!main1(int argc=0x039c84a4, char * * argv=0x0012f38c, 
nsISupports * nativeApp=0x039dcb95)  Line 1322	C++
 	mozilla.exe!main(int argc=0x00000005, char * * argv=0x003f7c58)  Line 
1812 + 0x16	C++
 	mozilla.exe!mainCRTStartup()  Line 400 + 0x11	C
 	kernel32.dll!GetCurrentDirectoryW()  + 0x44

Comment 1

[timeless]

-	argv,6	0x003f7c58	char * *
+	[0x0]	0x003f7c70 "mozilla.exe"	char *
+	[0x1]	0x003f7c7c "-P"	char *
+	[0x2]	0x003f7c7f "crash2"	char *
+	[0x3]	0x003f7c86 "-chatzilla"	char *
+	[0x4]	0x003f7c91 "-venkman"	char *
+	[0x5]	0x00000000 <Bad Ptr>	char *

Comment 2

[Alex Vincent [:WeirdAl]]

I hit this with a debug build of Venkman, trying to diagnose bug 104360.

Steps to reproduce:
(1) Ensure patch for bug 104360 is not applied.
(2) Launch SeaMonkey navigator window
(3) Open sidebar
(4) Launch Venkman
(5) Close SeaMonkey navigator window

Please also note bug 312651, which may be related.

Comment 3

[Eric Promislow]

I hit this with both Firebug and a JSD client I'm working on,
on Firefox 1.5.0.4 

I'm just trying to write some JS code (with callbacks), and don't
know whether it makes sense to try to kill a thread with a zero-stack-depth,
but here's the static call sequence.  The first condition in
jsd_NewThreadState is contradicted by the assertion made in
jsd_DestroyThreadState:

http://lxr.mozilla.org/mozilla1.8.0/source/js/jsd/jsd_stak.c#141

            if ((jsdthreadstate->stackDepth == 0 && !frame) ||
                (jsdthreadstate->stackDepth == 1 && frame &&
                 frame->jsdscript && !JSD_IS_DEBUG_ENABLED(jsdc, frame->jsdscript)))
            {
                /*
                 * if we failed to create the first frame, or the top frame
                 * is not enabled for debugging, fail the entire thread state.
                 */
                JS_INIT_CLIST(&jsdthreadstate->links);
                jsd_DestroyThreadState(jsdc, jsdthreadstate);
                return NULL;
            }

//----
http://lxr.mozilla.org/mozilla1.8.0/source/js/jsd/jsd_stak.c#170

jsd_DestroyThreadState(JSDContext* jsdc, JSDThreadState* jsdthreadstate)
{
    JSDStackFrameInfo* jsdframe;
    JSCList* list;

    JSD_ASSERT_VALID_THREAD_STATE(jsdthreadstate);

//----
http://lxr.mozilla.org/mozilla1.8.0/source/js/jsd/jsd_stak.c#45
void JSD_ASSERT_VALID_THREAD_STATE(JSDThreadState* jsdthreadstate)
{
    JS_ASSERT(jsdthreadstate);
    JS_ASSERT(jsdthreadstate->stackDepth > 0);
}

Comment 4

[James Ross]

Based on comment 3, I'm resolving this as a duplicate of bug 343511, which has now been fixed.

*** This bug has been marked as a duplicate of 343511 ***