crash in PLDHashTable::ChangeTable(int) while destroying PluginModuleChromeParent

RESOLVED WORKSFORME

Status

()

Core
XPCOM
--
critical
RESOLVED WORKSFORME
3 years ago
a month ago

People

(Reporter: baffclan, Unassigned)

Tracking

({crash})

40 Branch
x86_64
Windows 7
crash
Points:
---

Firefox Tracking Flags

(e10s-, firefox40 affected)

Details

(Whiteboard: ShutDownKill, crash signature)

(Reporter)

Description

3 years ago
This bug was filed from the Socorro interface and is 
report bp-bf9e3b08-4484-4923-912d-117d52150427.
=============================================================

--- 
Signature 	PLDHashTable::ChangeTable(int) More Reports Search
UUID 	bf9e3b08-4484-4923-912d-117d52150427
Date Processed	2015-04-27 07:37:59.385937
Uptime	30520
Last Crash	340201 seconds before submission
Install Age 	30520 since version was first installed.
Install Time 	2015-04-26 23:08:30
Product 	Firefox
Version 	40.0a1
Build ID 	20150426030248
Release Channel 	nightly
OS 	Windows NT
OS Version 	6.1.7601 Service Pack 1
Build Architecture 	amd64
Build Architecture Info 	family 6 model 58 stepping 9 | 4
Crash Reason 	EXCEPTION_ACCESS_VIOLATION_WRITE
Crash Address 	0x7fee593f1d8
User Comments 	Close Firefox window.
App Notes 	

AdapterVendorID: 0x8086, AdapterDeviceID: 0x0162, AdapterSubsysID: 00000000, AdapterDriverVersion: 9.17.10.2932
D2D- D2D1.1- D2D1.1+ D2D+ DWrite- DWrite+ D3D11 Layers- D3D11 Layers+ 

Processor Notes 	sp-processor07_phx1_mozilla_com.8514:2015; MozillaProcessorAlgorithm2015; earlier processing: 2015-04-27 07:38:32.813646; skunk_classifier: reject - not a plugin hang; sp-processor09_phx1_mozilla_com.24450:2015; MozillaProcessorAlgorithm2015; earlier processing: 2015-04-27 07:38:08.961568; skunk_classifier: reject - not a plugin hang; sp-processor09_phx1_mozilla_com.24450:2015; MozillaProcessorAlgorithm2015; skunk_classifier: reject - not a plugin hang
EMCheckCompatibility 	

True

Winsock LSP 	

MSAFD Tcpip [TCP/IP] : 2 : 1 :  
 MSAFD Tcpip [UDP/IP] : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [RAW/IP] : 2 : 3 :  
 MSAFD Tcpip [TCP/IPv6] : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [UDP/IPv6] : 2 : 2 :  
 MSAFD Tcpip [RAW/IPv6] : 2 : 3 : %SystemRoot%\system32\mswsock.dll 
 RSVP TCPv6 サービス プロバイダー : 2 : 1 :  
 RSVP TCP サービス プロバイダー : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 RSVP UDPv6 サービス プロバイダー : 2 : 2 :  
 RSVP UDP サービス プロバイダー : 2 : 2 : %SystemRoot%\system32\mswsock.dll

Adapter Vendor ID 	

0x8086

Adapter Device ID 	

0x0162

Total Virtual Memory 	

8796092891136

Available Virtual Memory 	

8795073679360

System Memory Use Percentage 	

40

Available Page File 	

13015257088

Available Physical Memory 	

5013000192
---
(Reporter)

Comment 1

3 years ago
Crashing Thread

Frame 	Module 	Signature 	Source
0 	xul.dll 	PLDHashTable::ChangeTable(int) 	xpcom/glue/pldhash.cpp
1 	xul.dll 	nsBaseHashtable<nsCStringHashKey, nsCString, nsCString>::Put(nsACString_internal const&, nsCString const&, mozilla::fallible_t const&) 	xpcom/glue/nsBaseHashtable.h
2 	xul.dll 	nsBaseHashtable<nsCStringHashKey, nsCString, nsCString>::Put(nsACString_internal const&, nsCString const&) 	xpcom/glue/nsBaseHashtable.h
3 	xul.dll 	mozilla::dom::CrashReporterParent::GenerateChildData(nsDataHashtable<nsCStringHashKey, nsCString> const*) 	dom/ipc/CrashReporterParent.cpp
4 	xul.dll 	mozilla::plugins::PluginModuleChromeParent::ProcessFirstMinidump() 	dom/plugins/ipc/PluginModuleParent.cpp
5 	xul.dll 	mozilla::plugins::PluginModuleChromeParent::ActorDestroy(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason) 	dom/plugins/ipc/PluginModuleParent.cpp
6 	xul.dll 	mozilla::plugins::PPluginModuleParent::OnChannelError() 	obj-firefox/ipc/ipdl/PPluginModuleParent.cpp
7 	xul.dll 	mozilla::ipc::MessageChannel::NotifyMaybeChannelError() 	ipc/glue/MessageChannel.cpp
8 	xul.dll 	mozilla::ipc::MessageChannel::Close() 	ipc/glue/MessageChannel.cpp
9 	xul.dll 	mozilla::plugins::PluginModuleParent::DoShutdown(short*) 	dom/plugins/ipc/PluginModuleParent.cpp
10 	xul.dll 	mozilla::plugins::PluginModuleParent::NP_Shutdown(short*) 	dom/plugins/ipc/PluginModuleParent.cpp
11 	xul.dll 	mozilla::plugins::PluginModuleChromeParent::~PluginModuleChromeParent() 	dom/plugins/ipc/PluginModuleParent.cpp
12 	xul.dll 	mozilla::plugins::PluginModuleChromeParent::`scalar deleting destructor'(unsigned int) 	
13 	xul.dll 	nsNPAPIPlugin::~nsNPAPIPlugin() 	dom/plugins/base/nsNPAPIPlugin.cpp
14 	xul.dll 	nsNPAPIPlugin::`scalar deleting destructor'(unsigned int) 	
15 	xul.dll 	gfxDrawable::Release() 	gfx/thebes/gfxDrawable.h
16 	xul.dll 	nsPluginTag::TryUnloadPlugin(bool) 	dom/plugins/base/nsPluginTags.cpp
17 	xul.dll 	nsPluginHost::UnloadPlugins() 	dom/plugins/base/nsPluginHost.cpp
18 	xul.dll 	nsPluginHost::Observe(nsISupports*, char const*, wchar_t const*) 	dom/plugins/base/nsPluginHost.cpp
19 	xul.dll 	nsObserverList::NotifyObservers(nsISupports*, char const*, wchar_t const*) 	xpcom/ds/nsObserverList.cpp
20 	xul.dll 	nsObserverService::NotifyObservers(nsISupports*, char const*, wchar_t const*) 	xpcom/ds/nsObserverService.cpp
21 	xul.dll 	mozilla::ShutdownXPCOM(nsIServiceManager*) 	xpcom/build/XPCOMInit.cpp
22 	xul.dll 	ScopedXPCOMStartup::~ScopedXPCOMStartup() 	toolkit/xre/nsAppRunner.cpp
23 	xul.dll 	mozilla::UniquePtr<ScopedXPCOMStartup, mozilla::DefaultDelete<ScopedXPCOMStartup> >::reset(ScopedXPCOMStartup*) 	mfbt/UniquePtr.h
24 	xul.dll 	XREMain::XRE_main(int, char** const, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
25 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp
26 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
27 	firefox.exe 	NS_internal_main(int, char**) 	browser/app/nsBrowserApp.cpp
28 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
29 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
30 	kernel32.dll 	BaseThreadInitThunk 	
31 	ntdll.dll 	RtlUserThreadStart 	
32 	kernel32.dll 	BasepReportFault 	
33 	kernel32.dll 	BasepReportFault
I looked at a few of the crashes with this signature in 40, and they all look like this: plugin IPC stuff is triggering crash reporter stuff and crashing.
tracking-e10s: --- → ?
Component: XPCOM → Plug-ins
(Reporter)

Comment 3

3 years ago
(In reply to Andrew McCreight [:mccr8] from comment #2)
Thanks for Comments.
I enabled e10s.

Updated

3 years ago
Flags: needinfo?(jmathies)
Note that we're in the middle of destroying the PluginModuleChromeParent here. That's why we're crashing.
The top level signature is not e10s specific (this is pretty generic), but the crashes like those in comment 0 are.
Summary: crash in PLDHashTable::ChangeTable(int) → crash in PLDHashTable::ChangeTable(int) while destroying PluginModuleChromeParent

Updated

3 years ago
Crash Signature: [@ PLDHashTable::ChangeTable(int)] → [@ PLDHashTable::ChangeTable(int)] [@ PLDHashTable::ChangeTable]
Blocks: 1219672
Component: Plug-ins → mozglue
Whiteboard: ShutDownKill
Version: Trunk → 40 Branch
Component: mozglue → XPCOM
No crashes with this signature on versions newer than 52, and there's only one, so I think we should just close this.
Status: NEW → RESOLVED
Last Resolved: a month ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.