Subj : Re: JS_ASSERT in js_DropScopeProperty
To   : Amit Garde <amadtiger@yahoo.com>
From : Brendan Eich <brendan@meer.net>
Date : Thu Feb 13 2003 02:12 pm

Amit Garde wrote:

>I'm using SpiderMonkey in a multithreaded environment on Windows 2000
>and I encounter random asserts while in js_DropScopeProperty, because
>sprop->nrefs is 0.
>

You're using an old, unsupported version of the engine.  Try upgrading 
to SpiderMonkey 1.5 RC5 -- see the announcement message at 
news://news.mozilla.org:119/b0a6u2$ipn2@ripley.netscape.com.

/be

>
>JSScopeProperty *
>js_DropScopeProperty(JSContext *cx, JSScope *scope, JSScopeProperty
>*sprop)
>{
>    JS_ASSERT(JS_IS_SCOPE_LOCKED(scope));
>    if (sprop) {
>	JS_ASSERT(sprop->nrefs > 0); // Asserted here
>	if (--sprop->nrefs == 0) {
>	    js_DestroyScopeProperty(cx, scope, sprop);
>	    sprop = NULL;
>	}
>    }
>    return sprop;
>}
>
>This is what the stack looks like at the time:
>
>NTDLL! 77f97704()
>js_DropScopeProperty(JSContext * 0x06d7b188, JSScope * 0x06dc6de8,
>JSScopeProperty * 0x00388350) line 517 + 83 bytes
>js_free_symbol(void * 0x06eefa10, JSHashEntry * 0x06ff0720, unsigned
>int 1) line 97 + 138 bytes
>JS_HashTableDestroy(JSHashTable * 0x0734d878) line 133 + 124 bytes
>js_hash_scope_clear(JSContext * 0x06d7b188, JSScope * 0x06dc6de8) line
>204 + 43 bytes
>js_DestroyScope(JSContext * 0x06d7b188, JSScope * 0x06dc6de8) line 411
>+ 141 bytes
>js_DestroyObjectMap(JSContext * 0x06d7b188, JSObjectMap * 0x06dc6de8)
>line 1045 + 81 bytes
>js_DropObjectMap(JSContext * 0x06d7b188, JSObjectMap * 0x06dc6de8,
>JSObject * 0x077708f8) line 1062 + 141 bytes
>js_FinalizeObject(JSContext * 0x06d7b188, JSObject * 0x077708f8) line
>1263 + 119 bytes
>js_GC(JSContext * 0x06d7b188) line 828 + 103 bytes
>js_ForceGC(JSContext * 0x06d7b188) line 614 + 43 bytes
>js_DestroyContext(JSContext * 0x06d7b188) line 130 + 43 bytes
>JS_DestroyContext(JSContext * 0x06d7b188) line 572 + 43 bytes
>
>Any suggestions why this might be happening? My assumption is that
>sprop->nrefs is only decremented in js_DropScopeProperty, and only
>incremented in js_SetProperty and js_HoldScopeProperty, so this is due
>to a mismatch in the number of times these get called for a given
>property. Are there any other ways this could happen? Which of the
>public API functions can lead to js_DropScopeProperty etc being
>called?
>
>Thanks for any input...
>
>Amit
>  
>

.