Bug 561444 - "Assertion failure: title->ownercx == cx || title->ownercx->thread == cx->thread, at ../jslock.cpp:1414" with multiple threads. r=igor.

--HG--
extra : rebase_source : 6749f4b86999cffc1abdcad79ef45f764ba165c2

js/src/jsapi-tests/testContexts.cpp

@@ -24,3 +24,50 @@ BEGIN_TEST(testContexts_IsRunning)
         return ok;
     }
 END_TEST(testContexts_IsRunning)
+
+#ifdef JS_THREADSAFE
+
+#include "prthread.h"
+
+struct ThreadData {
+    JSRuntime *rt;
+    JSObject *obj;
+    const char *code;
+    bool ok;
+};
+
+BEGIN_TEST(testContexts_bug561444)
+    {
+	const char *code = "<a><b/></a>.b.@c = '';";
+	EXEC(code);
+
+	jsrefcount rc = JS_SuspendRequest(cx);
+	{
+	    ThreadData data = {rt, global, code, false};
+	    PRThread *thread = 
+		PR_CreateThread(PR_USER_THREAD, threadMain, &data,
+				PR_PRIORITY_NORMAL, PR_LOCAL_THREAD, PR_JOINABLE_THREAD, 0);
+	    CHECK(thread);
+	    PR_JoinThread(thread);
+	    CHECK(data.ok);
+	}
+	JS_ResumeRequest(cx, rc);
+        return true;
+    }
+
+    static void threadMain(void *arg) {
+	ThreadData *d = (ThreadData *) arg;
+
+	JSContext *cx = JS_NewContext(d->rt, 8192);
+	if (!cx)
+	    return;
+	JS_BeginRequest(cx);
+	jsvalRoot v(cx);
+	if (!JS_EvaluateScript(cx, d->obj, d->code, strlen(d->code), __FILE__, __LINE__, v.addr()))
+	    return;
+	JS_DestroyContext(cx);
+	d->ok = true;
+    }
+END_TEST(testContexts_bug561444)
+
+#endif

js/src/jslock.cpp

@@ -1407,13 +1407,14 @@ js_IsTitleLocked(JSContext *cx, JSTitle *title)
         return JS_TRUE;
 
     /*
-     * General case: the title is either exclusively owned (by cx), or it has
-     * a thin or fat lock to cope with shared (concurrent) ownership.
+     * General case: the title is either exclusively owned by some context, or
+     * it has a thin or fat lock to cope with shared (concurrent) ownership.
+     *
+     * js_LockTitle(cx, title) must set ownercx to cx when claiming the title
+     * from another context on the same thread.
      */
-    if (title->ownercx) {
-        JS_ASSERT(title->ownercx == cx || title->ownercx->thread == cx->thread);
-        return JS_TRUE;
-    }
+    if (title->ownercx)
+        return title->ownercx == cx;
     return js_CurrentThreadId() ==
            ((JSThread *)Thin_RemoveWait(ReadWord(title->lock.owner)))->id;
 }

js/src/jsxml.cpp

@@ -7203,19 +7203,6 @@ js_GetXMLObject(JSContext *cx, JSXML *xml)
         return obj;
     }
 
-    /*
-     * A JSXML cannot be shared among threads unless it has an object.
-     * A JSXML cannot be given an object unless:
-     * (a) it has no parent; or
-     * (b) its parent has no object (therefore is thread-private); or
-     * (c) its parent's object is locked.
-     *
-     * Once given an object, a JSXML is immutable.
-     */
-    JS_ASSERT(!xml->parent ||
-              !xml->parent->object ||
-              JS_IS_OBJ_LOCKED(cx, xml->parent->object));
-
     obj = NewXMLObject(cx, xml);
     if (!obj)
         return NULL;