407803 - threads.js is out of date

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[Jason Orendorff [:jorendorff]]

js/src/xpconnect/tests/js/old/threads.js is a stress test of SpiderMonkey's JS_THREADSAFE threading support.  Because of a thread manager rewrite this year, the test no longer works.  The APIs it uses have changed.

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: nonworking patch to threads.js

With this patch, the test asserts many times and then crashes.  I had this conversation with Waldo about it in mid-November.

   <jorendorff> There are two kinds of assertions.
   <jorendorff> 1) A non-thread-safe object is allocated in the worker thread.
                Then that thread exits.
        <Waldo> and then it's GC'd and released on the other thread?
   <jorendorff> yes.
        <Waldo> basically, XPConnect doesn't currently support thread-unsafe
                objects which are only used on one thread
  * Waldo searches for the bug
   <jorendorff> ah.  maybe it used to at one point?  my code is an update of
                an old threads.js test
        <Waldo> bug 337648
   <jorendorff> I know it's old because it's in a directory called "old"
   <jorendorff> 2) the opposite, a non-thread-safe object is allocated in the
                main thread, then GC is triggered in a worker thread
        <Waldo> I don't think it ever supported it
   <jorendorff> and even though the worker thread isn't using that object,
   <jorendorff> GC of course collects everything, so it's shaken loose and
                collected
   <jorendorff> triggering the same assertion

I don't know why this used to work.

I haven't looked into the crash.  Here is the stack dump:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x000001a8
0x0282ea7b in XPCRootSetElem::AddToRootSet (this=0x6268b8, rt=0x0, listHead=0x6100db) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/src/xpcjsruntime.cpp:1404
1404        JS_LOCK_GC(rt);
(gdb) p rt
$1 = (JSRuntime *) 0x0
(gdb) bt
#0  0x0282ea7b in XPCRootSetElem::AddToRootSet (this=0x6268b8, rt=0x0, listHead=0x6100db) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/src/xpcjsruntime.cpp:1404
#1  0x02837a2a in nsXPCWrappedJS::AddRef (this=0x6268a0) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/src/xpcinlines.h:56
#2  0x028380f0 in nsXPCWrappedJS::nsXPCWrappedJS (this=0x6268a0, ccx=@0xbfffdf1c, aJSObj=0xe8160, aClass=0x6076a0, root=0x0, aOuter=0x0) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/src/xpcwrappedjs.cpp:439
#3  0x0283845f in nsXPCWrappedJS::GetNewOrUsed (ccx=@0xbfffdf1c, aJSObj=0xe8160, aIID=@0xbfffde18, aOuter=0x0, wrapperResult=0xbfffda8c) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/src/xpcwrappedjs.cpp:351
#4  0x028222f6 in XPCConvert::JSObject2NativeInterface (ccx=@0xbfffdf1c, dest=0xbfffdd88, src=0xe8160, iid=0xbfffde18, aOuter=0x0, pErr=0xbfffde40) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/src/xpcconvert.cpp:1292
#5  0x02824042 in XPCConvert::JSData2Native (ccx=@0xbfffdf1c, d=0xbfffdd88, s=950624, type=@0xbfffde95, useAllocator=0, iid=0xbfffde18, pErr=0xbfffde40) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/src/xpcconvert.cpp:1033
#6  0x02845631 in XPCWrappedNative::CallMethod (ccx=@0xbfffdf1c, mode=CALL_METHOD) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/src/xpcwrappednative.cpp:2181
#7  0x0284e8df in XPC_WN_CallMethod (cx=0x612a70, obj=0xe8180, argc=2, argv=0x205a154, vp=0xbfffe044) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1467
#8  0x0025b252 in js_Invoke (cx=0x612a70, argc=2, vp=0x205a14c, flags=0) at /Users/jason/dev/am/mozilla-central-merge/js/src/jsinterp.cpp:1358
#9  0x00251926 in js_Interpret (cx=0x612a70, pc=0x61d830 ":", result=0xbfffe54c) at /Users/jason/dev/am/mozilla-central-merge/js/src/jsinterp.cpp:4112
#10 0x0025a505 in js_Execute (cx=0x612a70, chain=0xe17e0, script=0x205d000, down=0x0, flags=0, result=0xbffff73c) at /Users/jason/dev/am/mozilla-central-merge/js/src/jsinterp.cpp:1603
#11 0x0020cfdc in JS_ExecuteScript (cx=0x612a70, obj=0xe17e0, script=0x205d000, rval=0xbffff73c) at /Users/jason/dev/am/mozilla-central-merge/js/src/jsapi.cpp:4763
#12 0x00002f14 in ProcessFile (cx=0x612a70, obj=0xe17e0, filename=0x205d000 "??\005\002k\001", file=0xa000bda0, forceTTY=0) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/shell/xpcshell.cpp:660
#13 0x000032e5 in Process (cx=0x612a70, obj=0xe17e0, filename=0xbffff9d5 "/Users/jason/dev/am/actionmonkey-dev/js/src/xpconnect/tests/js/old/threads.js", forceTTY=0) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/shell/xpcshell.cpp:739
#14 0x00004a58 in main (argc=2, argv=0xbffff8e8, envp=0xbffff8f4) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/shell/xpcshell.cpp:894
(gdb) info threads
  5 process 20059 thread 0x3147  0x900248c7 in semaphore_wait_signal_trap ()
  4 process 20059 thread 0x3047  0x900248c7 in semaphore_wait_signal_trap ()
  3 process 20059 thread 0x2f47  0x900248c7 in semaphore_wait_signal_trap ()
  2 process 20059 thread 0x190b  0x9001a1cc in select ()
* 1 process 20059 local thread 0x1307  0x0282ea7b in XPCRootSetElem::AddToRootSet (this=0x6268b8, rt=0x0, listHead=0x6100db) at /Users/jason/dev/am/mozilla-central-merge/js/src/xpconnect/src/xpcjsruntime.cpp:1404

Comment 2

[David Bradley]

FWIW this stress test used to crash before the API changes. Just be aware if anyone tackles this issue. There were some threading issues in XPConnect on the addref/release logic of either the wrapped natives or wrapped JS classes. One was fixed the other was left. Unless I missed a fix that came in. The stack doesn't seem to indicate either of those issues.

Comment 3

[Jason Orendorff [:jorendorff]]

We can just delete the test, right?  It seems to be testing fantasy functionality.

Since I posted this, the js shell has grown multithreading testing features and we now have some regression tests for JS_THREADSAFE, though not for XPCOM.  The new tests are in js/tests/js1_8/extensions, landed as part of bug 404879.

Comment 4

[Jason Orendorff [:jorendorff]]

Long gone.