340086 - assertion failed in js_AllocGCThing while js_GC is running in a multithreaded environment

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Christian Fruth]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)
Build Identifier: JavaScript-C 1.5 pre-release 6a 2004-06-09

if one thread is cleaning up the memory by calling js_GC, for example if the
script ends and a second thread using the same JS_Runtime-Instance tries to
allocate memory by calling JS_AllocGCThing than it can happen that JS_AllocGCThing
abort due to a failed assertion.

This happens because js_GC is releasing the GC-lock in line 1188 so that all
requests will wait for rt->gcLevel drop to 0 but in JS_AllocGCThing
an assertion will check if gc is running (line 472) after the GC-lock was
accquired

Reproducible: Always

Steps to Reproduce:
It's a multithreading-problem, so it's a little bit tricky to reproduce it

1. use same instance of JS_Runtime for all threads
2. a new JS_Context for each thread
3. start a script in Thread A
4. wait until Thread finished processing its script and running js_GC to clean
up memory
5. in that moment start a new script in a second thread which for example needs
to allocate a string using JS_NewString, which than calls JS_AllocGCThing
Actual Results:  
An assertion failed in line 472 of jsgc.c
JS_ASSERT(!rt->gcRunning);

Expected Results:  
Waiting in line 471 of jsgc.c until js_GC is over

Comment 1

[Brendan Eich [:brendan]]

You are not using JS_BeginRequest and JS_EndRequest around scripts that might allocate.  That's required in JS_THREADSAFE embeddings.

/be

Comment 2

[Brendan Eich [:brendan]]

Since you noticed how the synchronization with requests wanting to resume or begin worked, it should be clear that you need to bracket all JS API usage with requests. The API entry points don't do this themselves, because requests have certain overhead, so it's up to you to amortize it across maximal sequenes of non-blocking code mixed with API calls.

If your native hooks (branch callback, function, class hook, etc.) could block or take a long time computing, you need to suspend and resume any requests using the JS_SuspendRequest and JS_ResumeRequest APIs.

/be