Subj : JS_ASSERT in js_DropScopeProperty
To   : netscape.public.mozilla.jseng
From : amadtiger@yahoo.com (Amit Garde)
Date : Thu Feb 13 2003 01:10 am

I'm using SpiderMonkey in a multithreaded environment on Windows 2000
and I encounter random asserts while in js_DropScopeProperty, because
sprop->nrefs is 0.

JSScopeProperty *
js_DropScopeProperty(JSContext *cx, JSScope *scope, JSScopeProperty
*sprop)
{
    JS_ASSERT(JS_IS_SCOPE_LOCKED(scope));
    if (sprop) {
	JS_ASSERT(sprop->nrefs > 0); // Asserted here
	if (--sprop->nrefs == 0) {
	    js_DestroyScopeProperty(cx, scope, sprop);
	    sprop = NULL;
	}
    }
    return sprop;
}

This is what the stack looks like at the time:

NTDLL! 77f97704()
js_DropScopeProperty(JSContext * 0x06d7b188, JSScope * 0x06dc6de8,
JSScopeProperty * 0x00388350) line 517 + 83 bytes
js_free_symbol(void * 0x06eefa10, JSHashEntry * 0x06ff0720, unsigned
int 1) line 97 + 138 bytes
JS_HashTableDestroy(JSHashTable * 0x0734d878) line 133 + 124 bytes
js_hash_scope_clear(JSContext * 0x06d7b188, JSScope * 0x06dc6de8) line
204 + 43 bytes
js_DestroyScope(JSContext * 0x06d7b188, JSScope * 0x06dc6de8) line 411
+ 141 bytes
js_DestroyObjectMap(JSContext * 0x06d7b188, JSObjectMap * 0x06dc6de8)
line 1045 + 81 bytes
js_DropObjectMap(JSContext * 0x06d7b188, JSObjectMap * 0x06dc6de8,
JSObject * 0x077708f8) line 1062 + 141 bytes
js_FinalizeObject(JSContext * 0x06d7b188, JSObject * 0x077708f8) line
1263 + 119 bytes
js_GC(JSContext * 0x06d7b188) line 828 + 103 bytes
js_ForceGC(JSContext * 0x06d7b188) line 614 + 43 bytes
js_DestroyContext(JSContext * 0x06d7b188) line 130 + 43 bytes
JS_DestroyContext(JSContext * 0x06d7b188) line 572 + 43 bytes

Any suggestions why this might be happening? My assumption is that
sprop->nrefs is only decremented in js_DropScopeProperty, and only
incremented in js_SetProperty and js_HoldScopeProperty, so this is due
to a mismatch in the number of times these get called for a given
property. Are there any other ways this could happen? Which of the
public API functions can lead to js_DropScopeProperty etc being
called?

Thanks for any input...

Amit

.