Assertion failure: jsdthreadstate->stackDepth > 0, at r:/mozilla/js/jsd/jsd_stak.c:48

VERIFIED DUPLICATE of bug 343511

Status

Other Applications
Venkman JS Debugger
--
critical
VERIFIED DUPLICATE of bug 343511
14 years ago
9 years ago

People

(Reporter: timeless, Assigned: timeless)

Tracking

({assertion, crash, testcase})

Trunk
x86
Windows XP
assertion, crash, testcase

Firefox Tracking Flags

(Not tracked)

Details

(Assignee)

Description

14 years ago
js3250.dll!JS_Assert(const char * s=0x017e4430, const char * 
file=0x017e446c, int ln=0x00000030)  Line 155	C
 	jsd3250.dll!JSD_ASSERT_VALID_THREAD_STATE(JSDThreadState * 
jsdthreadstate=0x03be5328)  Line 48 + 0x10	C
 	jsd3250.dll!jsd_DestroyThreadState(JSDContext * jsdc=0x00f94ef8, 
JSDThreadState * jsdthreadstate=0x03be5328)  Line 175 + 0xb	C
>	jsd3250.dll!jsd_NewThreadState(JSDContext * jsdc=0x00f94ef8, JSContext 
* cx=0x012654b0)  Line 151	C
 	jsd3250.dll!jsd_CallExecutionHook(JSDContext * jsdc=0x00f94ef8, 
JSContext * cx=0x012654b0, unsigned int type=0x00000002, unsigned int 
(JSDContext *, JSDThreadState *, unsigned int, void *, long *)* 
hook=0x017e1a85, void * hookData=0x00000000, long * rval=0x0012f180)  Line 165 
+ 0x1b	C
 	jsd3250.dll!jsd_DebugErrorHook(JSContext * cx=0x012654b0, const char * 
message=0x03abd428, JSErrorReport * report=0x0012f1ac, void * 
closure=0x00000000)  Line 365 + 0x16	C
 	js3250.dll!ReportError(JSContext * cx=0x03be5328, const char * 
message=0x03abd428, JSErrorReport * reportp=0x01061e1f)  Line 340 + 0xe	C
 	js3250.dll!js_ReportErrorNumberVA(JSContext * cx=0x012654b0, unsigned 
int flags=0x03abd428, const JSErrorFormatString * (void *, const char *, const 
unsigned int)* callback=0x01061d2f, void * userRef=0x00000000, const unsigned 
int errorNumber=0x00000027, int charArgs=0x00000001, char * ap=0x0012f214)  
Line 632	C
 	js3250.dll!JS_ReportErrorNumber(JSContext * cx=0x012654b0, const 
JSErrorFormatString * (void *, const char *, const unsigned int)* 
errorCallback=0x01061d2f, void * userRef=0x00000000, const unsigned int 
errorNumber=0x00000027, ...)  Line 3983 + 0x19	C
 	js3250.dll!js_ValueToNonNullObject(JSContext * cx=0x012654b0, long 
v=0x00000000)  Line 3717 + 0x18	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0012f38c, long * 
result=0x039dcb95)  Line 3202 + 0x55	C
 	js3250.dll!js_Invoke(JSContext * cx=0x039c84a4, unsigned int 
argc=0x0012f38c, unsigned int flags=0x039dcb95)  Line 1301 + 0xa	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x02e07c68, JSObject * 
obj=0x039b2bf0, long fval=0x039b2ca0, unsigned int flags=0x00000000, unsigned 
int argc=0x00000000, long * argv=0x00000000, long * rval=0x0012f660)  Line 1378 
+ 0xe	C
 	js3250.dll!js_InternalGetOrSet(JSContext * cx=0x012654b0, JSObject * 
obj=0x039b2bf0, long id=0x039cf060, long fval=0x039b2ca0, JSAccessMode 
mode=JSACC_READ, unsigned int argc=0x00000000, long * argv=0x00000000, long * 
rval=0x0012f660)  Line 1421 + 0x19	C
 	js3250.dll!js_GetProperty(JSContext * cx=0x012654b0, JSObject * 
obj=0x039b2bf0, long id=0x039cf060, long * vp=0x0012f660)  Line 2801 + 0x1d
	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0012f38c, long * 
result=0x039dcb95)  Line 3202 + 0xb9	C
 	js3250.dll!js_Invoke(JSContext * cx=0x039c84a4, unsigned int 
argc=0x0012f38c, unsigned int flags=0x039dcb95)  Line 1301 + 0xa	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x02e07c50, JSObject * 
obj=0x039b2bf0, long fval=0x039f5a58, unsigned int flags=0x00000000, unsigned 
int argc=0x00000000, long * argv=0x00000000, long * rval=0x0012f958)  Line 1378 
+ 0xe	C
 	js3250.dll!js_InternalGetOrSet(JSContext * cx=0x012654b0, JSObject * 
obj=0x039b2bf0, long id=0x029c4508, long fval=0x039f5a58, JSAccessMode 
mode=JSACC_READ, unsigned int argc=0x00000000, long * argv=0x00000000, long * 
rval=0x0012f958)  Line 1421 + 0x19	C
 	js3250.dll!js_GetProperty(JSContext * cx=0x012654b0, JSObject * 
obj=0x039b2bf0, long id=0x029c4508, long * vp=0x0012f958)  Line 2801 + 0x1d
	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0012f38c, long * 
result=0x039dcb95)  Line 3202 + 0xb9	C
 	js3250.dll!js_Invoke(JSContext * cx=0x039c84a4, unsigned int 
argc=0x0012f38c, unsigned int flags=0x039dcb95)  Line 1301 + 0xa	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0012f38c, long * 
result=0x039dcb95)  Line 3376	C
 	js3250.dll!js_Invoke(JSContext * cx=0x039c84a4, unsigned int 
argc=0x0012f38c, unsigned int flags=0x039dcb95)  Line 1301 + 0xa	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x012654dc, JSObject * 
obj=0x011e8390, long fval=0x039f6c80, unsigned int flags=0x00000000, unsigned 
int argc=0x00000001, long * argv=0x02fa8ff8, long * rval=0x0012fd90)  Line 1378 
+ 0xe	C
 	js3250.dll!JS_CallFunctionValue(JSContext * cx=0x012654b0, JSObject * 
obj=0x011e8390, long fval=0x039f6c80, unsigned int argc=0x00000001, long * 
argv=0x02fa8ff8, long * rval=0x0012fd90)  Line 3711 + 0x1c	C
 	gklayout.dll!nsJSContext::CallEventHandler(JSObject * 
aTarget=0x011e8390, JSObject * aHandler=0x039f6c80, unsigned int 
argc=0x00000001, long * argv=0x02fa8ff8, long * rval=0x0012fd90)  Line 1345 + 
0x18	C++
 	gklayout.dll!GlobalWindowImpl::RunTimeout(nsTimeoutImpl * 
aTimeout=0x00000000)  Line 5054	C++
 	gklayout.dll!GlobalWindowImpl::TimerCallback(nsITimer * 
aTimer=0x03a1c730, void * aClosure=0x03a1c660)  Line 5413	C++
 	xpcom.dll!nsTimerImpl::Fire()  Line 383 + 0x7	C++
 	xpcom.dll!nsTimerManager::FireNextIdleTimer()  Line 617	C++
 	gkwidget.dll!nsAppShell::Run()  Line 142	C++
 	appshell.dll!nsAppShellService::Run()  Line 489	C++
 	mozilla.exe!main1(int argc=0x039c84a4, char * * argv=0x0012f38c, 
nsISupports * nativeApp=0x039dcb95)  Line 1322	C++
 	mozilla.exe!main(int argc=0x00000005, char * * argv=0x003f7c58)  Line 
1812 + 0x16	C++
 	mozilla.exe!mainCRTStartup()  Line 400 + 0x11	C
 	kernel32.dll!GetCurrentDirectoryW()  + 0x44
(Assignee)

Comment 1

14 years ago
-	argv,6	0x003f7c58	char * *
+	[0x0]	0x003f7c70 "mozilla.exe"	char *
+	[0x1]	0x003f7c7c "-P"	char *
+	[0x2]	0x003f7c7f "crash2"	char *
+	[0x3]	0x003f7c86 "-chatzilla"	char *
+	[0x4]	0x003f7c91 "-venkman"	char *
+	[0x5]	0x00000000 <Bad Ptr>	char *
Keywords: crash
Product: Core → Other Applications
I hit this with a debug build of Venkman, trying to diagnose bug 104360.

Steps to reproduce:
(1) Ensure patch for bug 104360 is not applied.
(2) Launch SeaMonkey navigator window
(3) Open sidebar
(4) Launch Venkman
(5) Close SeaMonkey navigator window

Please also note bug 312651, which may be related.
Keywords: assertion, testcase

Comment 3

12 years ago
I hit this with both Firebug and a JSD client I'm working on,
on Firefox 1.5.0.4 

I'm just trying to write some JS code (with callbacks), and don't
know whether it makes sense to try to kill a thread with a zero-stack-depth,
but here's the static call sequence.  The first condition in
jsd_NewThreadState is contradicted by the assertion made in
jsd_DestroyThreadState:

http://lxr.mozilla.org/mozilla1.8.0/source/js/jsd/jsd_stak.c#141

            if ((jsdthreadstate->stackDepth == 0 && !frame) ||
                (jsdthreadstate->stackDepth == 1 && frame &&
                 frame->jsdscript && !JSD_IS_DEBUG_ENABLED(jsdc, frame->jsdscript)))
            {
                /*
                 * if we failed to create the first frame, or the top frame
                 * is not enabled for debugging, fail the entire thread state.
                 */
                JS_INIT_CLIST(&jsdthreadstate->links);
                jsd_DestroyThreadState(jsdc, jsdthreadstate);
                return NULL;
            }

//----
http://lxr.mozilla.org/mozilla1.8.0/source/js/jsd/jsd_stak.c#170

jsd_DestroyThreadState(JSDContext* jsdc, JSDThreadState* jsdthreadstate)
{
    JSDStackFrameInfo* jsdframe;
    JSCList* list;

    JSD_ASSERT_VALID_THREAD_STATE(jsdthreadstate);

//----
http://lxr.mozilla.org/mozilla1.8.0/source/js/jsd/jsd_stak.c#45
void JSD_ASSERT_VALID_THREAD_STATE(JSDThreadState* jsdthreadstate)
{
    JS_ASSERT(jsdthreadstate);
    JS_ASSERT(jsdthreadstate->stackDepth > 0);
}

Comment 4

12 years ago
Based on comment 3, I'm resolving this as a duplicate of bug 343511, which has now been fixed.

*** This bug has been marked as a duplicate of 343511 ***
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → DUPLICATE
(Assignee)

Updated

9 years ago
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.