398114 - JS_Assert: (cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread from nsJSSh::Init

Status: RESOLVED FIXED

(SeaMonkey :: General, defect)

Description

[Chris Shoemaker]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.5) Gecko/20070718 Fedora/2.0.0.5-1.fc7 Firefox/2.0.0.5
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a9pre) Gecko/2007093022 Minefield/3.0a9pre

#0  JS_Assert (
    s=0x2e0a10 "(cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread", file=0x2e09e0 "/home/chris/git/hm/lib/mozilla/js/src/jsapi.c", ln=4252)
    at /home/chris/git/hm/lib/mozilla/js/src/jsutil.c:63
#1  0x00237b2b in JS_DefineFunctions (cx=0x9bb7f70, obj=0xb3673aa0, 
    fs=0x22cbac0) at /home/chris/git/hm/lib/mozilla/js/src/jsapi.c:4252
#2  0x022bf818 in nsJSSh::Init (this=0x9f8b288)
    at /home/chris/git/hm/lib/mozilla/extensions/jssh/nsJSSh.cpp:619
#3  0x001b9c09 in NS_InvokeByIndex_P ()
    at /home/chris/git/hm/lib/mozilla/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:73
#4  0x001abdac in nsProxyObjectCallInfo::Run (this=0x9a42ed8)
    at /home/chris/git/hm/lib/mozilla/xpcom/proxy/src/nsProxyEvent.cpp:181
#5  0x001a380b in nsThread::ProcessNextEvent (this=0x8ca8088, mayWait=1, 
    result=0xbf9b0c20)
    at /home/chris/git/hm/lib/mozilla/xpcom/threads/nsThread.cpp:490
#6  0x0013fed1 in NS_ProcessNextEvent_P (thread=0x8ca8088, mayWait=1)
    at nsThreadUtils.cpp:227
#7  0x050bd2f9 in nsBaseAppShell::Run (this=0x8d8e398)
    at /home/chris/git/hm/lib/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154


Reproducible: Always

Steps to Reproduce:
1. build with --enable-extensions=default,jssh
2. start app
3. telnet localhost 9997

Comment 1

[Chris Shoemaker]

I'm trying to work through this by monkey patching it, and I got a little further.
Now it crashes after the first statement execution:

#0  JS_Assert (
    s=0x92ca10 "(cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread", file=0x92c9e0 "/home/chris/git/hm/lib/mozilla/js/src/jsapi.c", ln=4462)
    at /home/chris/git/hm/lib/mozilla/js/src/jsutil.c:63
#1  0x00889420 in JS_BufferIsCompilableUnit (cx=0xa662750, obj=0xb2c5b6a0, 
    bytes=0xa69018c "help()\n", length=7)
    at /home/chris/git/hm/lib/mozilla/js/src/jsapi.c:4462
#2  0x0763ef5c in nsJSSh::IsBufferCompilable (this=0xa690160, 
    _retval=0xb6933288)
    at /home/chris/git/hm/lib/mozilla/extensions/jssh/nsJSSh.cpp:700
#3  0x001b9c09 in NS_InvokeByIndex_P ()
    at /home/chris/git/hm/lib/mozilla/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:73
#4  0x001abdac in nsProxyObjectCallInfo::Run (this=0xa6b4ac0)
    at /home/chris/git/hm/lib/mozilla/xpcom/proxy/src/nsProxyEvent.cpp:181
#5  0x001a380b in nsThread::ProcessNextEvent (this=0x93cf730, mayWait=1, 
    result=0xbfb35590)
    at /home/chris/git/hm/lib/mozilla/xpcom/threads/nsThread.cpp:490
#6  0x0013fed1 in NS_ProcessNextEvent_P (thread=0x93cf730, mayWait=1)
    at nsThreadUtils.cpp:227
#7  0x01fc02f9 in nsBaseAppShell::Run (this=0x94b0d70)
    at /home/chris/git/hm/lib/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
#8  0x01065d4f in nsAppStartup::Run (this=0x94e0660)
    at /home/chris/git/hm/lib/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170

Comment 2

[Chris Shoemaker]

And here's another one.  Hopefully the last:

#0  JS_Assert (s=0x1c9a10 "(cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread", 
    file=0x1c99e0 "/home/chris/git/hm/lib/mozilla/js/src/jsapi.c", ln=3709)
    at /home/chris/git/hm/lib/mozilla/js/src/jsutil.c:63
#1  0x00121485 in JS_ClearScope (cx=0x99312b8, obj=0xb36608e0)
    at /home/chris/git/hm/lib/mozilla/js/src/jsapi.c:3709
#2  0x012ff311 in nsJSSh::Cleanup (this=0x9e74ff8)
    at /home/chris/git/hm/lib/mozilla/extensions/jssh/nsJSSh.cpp:642
#3  0x004a1c09 in NS_InvokeByIndex_P ()
    at /home/chris/git/hm/lib/mozilla/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:73
#4  0x00493dac in nsProxyObjectCallInfo::Run (this=0x9e71048)
    at /home/chris/git/hm/lib/mozilla/xpcom/proxy/src/nsProxyEvent.cpp:181

Comment 3

[Robert Sayre]

Attachment: use request model

Let me know if this patch works for you.

Comment 4

[Chris Shoemaker]

Hmm, I guess I had further to go than I thought.  I had only 3 of those 13 locally.  Thanks for the patch, I'll try it out now.

Comment 5

[Chris Shoemaker]

That patch at least fixes two of the assertion failures I was hitting, but it doesn't solve a third.  This one is triggered by sending jssh "exit()".  Or at least, there's still an assertion failure for that action, even if the assertion is different (Assertion failure: cx->requestDepth > 0).

#0  JS_Assert (s=0x1c8cc4 "cx->requestDepth > 0", 
    file=0x1c99e0 "/home/chris/git/hm/lib/mozilla/js/src/jsapi.c", ln=868)
    at /home/chris/git/hm/lib/mozilla/js/src/jsutil.c:63
#1  0x00127612 in JS_EndRequest (cx=0x93f79a8)
    at /home/chris/git/hm/lib/mozilla/js/src/jsapi.c:868
#2  0x03c7aed3 in ~JSAutoRequest (this=0xbff3f0d4) at jsapi.h:460
#3  0x03c78383 in nsJSSh::Cleanup (this=0x940fe58)
    at /home/chris/git/hm/lib/mozilla/extensions/jssh/nsJSSh.cpp:669
#4  0x0028ac09 in NS_InvokeByIndex_P ()
    at /home/chris/git/hm/lib/mozilla/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:73

Comment 6

[Robert Sayre]

Attachment: don't call JS_DestroyContext in a request

oops, try this

Comment 7

[Frank Wein [:mcsmurf]]

Looks like a bug ;).

Comment 8

[Chris Shoemaker]

Yes, the second patch works for me.  I haven't hit an assertion failure with it yet.  Thanks.  bz sr'd my last patch for jssh, so maybe he'd do this one, too?

Comment 9

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 283416 [details] [diff] [review]
don't call JS_DestroyContext in a request

This needs review from someone who understands the request model... but isn't doing JS_GC while inside a request bad?

Comment 10

[Brendan Eich [:brendan]]

(In reply to comment #9)
> (From update of attachment 283416 [details] [diff] [review])
> This needs review from someone who understands the request model...

Request it, igor or mrbkap or me (I'm last, baby in hospital)?

> but isn't
> doing JS_GC while inside a request bad?

No.

/be

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 283416 [details] [diff] [review]
don't call JS_DestroyContext in a request

Doing JS_GC in a request is fine and is the intended use of requests (as GCs can nest arbitrarily inside requests).

Comment 12

[Mike Shaver (:shaver emeritus)]

Comment on attachment 283416 [details] [diff] [review]
don't call JS_DestroyContext in a request

sr=shaver