1123868 - crash in js::detail::HashTable<js::HashMapEntry<JSAddonId*, nsCOMPtr<nsIAddonInterposition> >, js::HashMap<JSAddonId*, nsCOMPtr<nsIAddonInterposition>, js::PointerHasher<JSAddonId*, int>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::...

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

This bug was filed from the Socorro interface and is 
report bp-e44c1c3f-97e6-48b0-bda5-8a6ce2150120.
=============================================================

Windows 8.1
Firefox Nightly with e10s enabled and set to always use the private browsing mode
Upgraded from 20150115030228 to 20150120030203

The browser crashes after clicking the Restart button in the update billboard window. Launching it again works without issues.

Installed extensions:
ADB Helper	0.7.3	true	[e-mail]
British English Dictionary	1.19.1	true	[e-mail]
DOM Inspector	2.0.15	true	[e-mail]
Firefox Developer Tools Adapters	0.2.3	true	[e-mail]
LastPage	0.2.6	true	lastpage@thelittlespark
Console²	0.9	false	{1280606b-2510-4fe0-97ef-9b5a22eafe80}
Extension Test	2.15	false	[e-mail]
FlashGot	1.5.6.8	false	{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
Microsoft .NET Framework Assistant	1.2.1	false	{20a82645-c095-46ed-80e3-08825760534b}

Comment 1

[Andrew McCreight [:mccr8]]

This is a read of a poisoned value, so we have some kind of use-after-free.

Comment 2

[Andrew McCreight [:mccr8]]

It looks like the addon interposition map is involved.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: clear-interpositions

I guess it's possible we create a new scope after the shutdown notification. It's hard to tell from the stack. But it doesn't hurt to be defensive.

I don't see anything else wrong with the code, so hopefully this will fix the problem.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/130c3d209be1

Comment 5

[Andrew McCreight [:mccr8]]

Archaeopteryx, we're not entirely sure this fixes the issue, so let us know if you see this again after this gets into Nightly.  Thanks.

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/130c3d209be1

Comment 7

[Al Billings [:abillings - ex-MoCo]]

How far back did this go? Did it affect ESR31?

Comment 8

[Andrew McCreight [:mccr8]]

This is disabled everywhere except trunk.  I think the code didn't even land on 31.