Trunk M097 crashes [@ _hashFreeEntry]

VERIFIED WORKSFORME

Status

()

Core
XPCOM
--
critical
VERIFIED WORKSFORME
17 years ago
4 years ago

People

(Reporter: greer, Assigned: dbaron)

Tracking

({crash, topcrash})

Trunk
x86
Windows 2000
crash, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

17 years ago
This one in showing up midway in the M097 topcrash reports. The user comments 
look like they should produce some leads, but I have been unsuccessful at 
recreating this one myself. I will add the M097 and Trunk info to get some help 
reproducing this one.

M097 Incidents and Stack:
 

         _hashFreeEntry [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp  
line 175]
         PL_HashTableFinalize   
[d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp  line 117]
         nsHashtable::~nsHashtable      
[d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp  line
253]
         HTMLStyleSheetImpl::~HTMLStyleSheetImpl
[d:\builds\seamonkey\mozilla\content\html\style\src\nsHTMLStyleSheet.cpp  line 
706]
         nsDocument::~nsDocument
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp  line 522]
         nsHTMLDocument::~nsHTMLDocument
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp  line 
301]
         nsHTMLDocument::`scalar deleting destructor'
         nsDocument::Release    
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp  line
580]
         nsHTMLDocument::Release
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp  line 
306]
         XPCJSRuntime::GCCallback
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcjsruntime.cpp  line 522]
         0x01f02abc
         nsVoidArray::Clear     
[d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp  line 597]
 
        Source File : 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/xpcom/ds/nsHashtable.cpp
line : 175
     (1469760)  URL: slashdot.org
     (1438333)  URL: http://www.slashdot.org
     (1438333)  Comments: Clicking a link on www.slashdot.org
     (1438247)  URL: 
http://cgi.ebay.co.uk/aw-cgi/eBayISAPI.dll?ViewItem&item=1500383426
     (1438247)  Comments: I as in: 
http://www.mame.net/cgi-bin/wwwthreads/showpost.pl?Board=mamegeneral&Number=6255
6&page=0&view=expanded&mode=threaded&sb=7#Post62556When
I clicked the link that caused the crash
     (1432113)  URL: http://www.slovnik.cz/
     (1419587)  Comments: Opening a flash file with the navigator
     (1393788)  URL: arstechnica.infopop.net
     (1387328)  URL: http://www.theraouls.multimania.com
     (1387328)  Comments: Mozilla crashed when I closed it.
     (1374062)  Comments: During a reload of a page. Previous this page generate 
a new browser
windows
     (1347092)  URL: mozilla.org/start.htm(or something similar)
     (1347092)  Comments: clicking on a gosh-darned link  by golly. Is it my 
imagination or is this
later version more unstable than about the last 5 major dot releases?
     (1264922)  URL: tomshardware.com....
     (1264922)  Comments: poping open a few pages via right-click-open in new 
window
     (1245696)  Comments: Closing the tab.
     (1140732)  URL: http://macsat.dhs.org/~ksn/billeder/nytaar2001/
     (1140732)  Comments: looking on html pages with pics  no dynamics etc.
     (1135311)  URL: www.smh.com.au
     (1135311)  Comments: Scrolling the page
     (1121089)  URL: www.fhm.com
     (1114909)  URL: http://aspn.activestate.com/ASPN/Downloads/Komodo/More
     (1098827)  URL: http://news.bbc.co.uk
     (1094167)  URL: 
http://www.rollingstone.com/artists/bio.asp?afl=0001&oid=394


Trunk Stack and comments:

Build ID range: 2001123011 to 2002010906

         _hashFreeEntry [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp  
line 175]
         PL_HashTableRawRemove  [../../../lib/ds/plhash.c  line 333]
         PL_HashTableEnumerateEntries   [../../../lib/ds/plhash.c  line 451]
         nsHashtable::Reset     
[d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp  line 391]
 
        Source File : 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/xpcom/ds/nsHashtable.cpp
line : 175
     (1439594)  Comments: closing Mozilla
     (1437571)  URL: community.roxen.com
     (1387050)  URL: Ubid.com
     (1387050)  Comments: Leaving page (had been logged into a secure page
     (1358129)  Comments: typing in a URL
     (1219974)  URL: www.ftor.de
     (1216098)  Comments: selected the edit feature in UBBthreads BBS
     (1155289)  Comments: kbb.com
(Reporter)

Comment 1

17 years ago
Adding qawanted in hopes of getting a good repro case. Adding topcrash keyword 
for talkback tracking.
Keywords: crash, qawanted, topcrash

Comment 2

17 years ago
let style sheets owner have the first crack at this.  Make sure that your
finalize function is fine.
Assignee: dougt → dbaron
Component: XPCOM → Style System
QA Contact: scc → ian
Created attachment 64697 [details]
stacks with _hashFreeEntry signature for past 10 days

Looking through the talkback data it looks like there are many different stacks
here, and only some have to do with stylesheets.
Build dates on which this crash occurred:

      3	2001122010
      1	2001122211
      1	2001122506
      2	2001122609
      6	2001122809
      1	2001122911
      1	2001123011
      1	2002010106
      1	2002010110
      2	2002010206
      3	2002010209
      1	2002010310
      1	2002010406
      5	2002010409
      3	2002010611
      1	2002010706
      2	2002010709
      2	2002010810
      1	2002010906
This looks very difficult to crack since there's almost nothing to go on. 
There's a chance it could begin to make more sense if I could see disassembly
and registers for 3 or 4 of the different stacks, along with the stacks to which
they correspond and the relevant build dates for each.
Component: Style System → XPCOM

Comment 6

17 years ago
Created attachment 65460 [details]
_hashFreeEntry crashes for Mozilla 0.9.7 (M097) - grouped  by unique stack traces

Looking at the Talkback data for Mozilla 0.9.7, I noticed most of the stack
traces looked something like this:

_hashFreeEntry
[d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp  line 175] 
	 PL_HashTableFinalize
[d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp  line 117] 
	 nsHashtable::~nsHashtable
[d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp  line 253] 
	 nsHashtable::~nsHashtable
[d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp  line 247] 
	 RuleHash::~RuleHash
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSStyleSheet.cpp  line
294] 
	 CSSRuleProcessor::~CSSRuleProcessor
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSStyleSheet.cpp  line
3170] 
	 CSSRuleProcessor::`scalar deleting destructor'  
	 NameSpaceManagerImpl::Release
[d:\builds\seamonkey\mozilla\content\base\src\nsNameSpaceManager.cpp  line 418]

	 nsSupportsArray::Clear
[d:\builds\seamonkey\mozilla\xpcom\ds\nsSupportsArray.cpp  line 601] 
	 StyleSetImpl::RecycleArray
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp  line 389] 
	 StyleSetImpl::RemoveAgentStyleSheet
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp  line 768] 
	 PresShell::Destroy
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 1657] 
	 DocumentViewerImpl::Show
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp  line 1557] 

	 PresShell::UnsuppressPainting
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 4789] 
	 DocumentViewerImpl::LoadComplete
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp  line 1208] 

	 nsDocShell::EndPageLoad
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp  line 3419] 
	 nsWebShell::EndPageLoad
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp  line 923] 
	 nsDocShell::OnStateChange
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp  line 3327] 
	 nsDocLoaderImpl::FireOnStateChange
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp  line 1110] 
	 nsDocLoaderImpl::doStopDocumentLoad
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp  line 749] 
	 nsDocLoaderImpl::DocLoaderIsEmpty
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp  line 647] 
	 nsDocLoaderImpl::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp  line 578] 
	 nsLoadGroup::RemoveRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp  line 530] 
	 imgRequestProxy::OnStopRequest
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgRequestProxy.cpp  line 369]

	 imgRequest::OnStopRequest
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgRequest.cpp  line 612] 
	 ProxyListener::OnStopRequest
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgLoader.cpp	line 490] 
	 nsStreamListenerTee::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp  line 25]

	 nsHttpChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line
2386] 
	 nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line
213] 
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591] 
	 PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524] 
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]  

I have attached all the unique stack traces for this crash found in Mozilla
0.9.7 Talkback data.
(Reporter)

Comment 7

17 years ago
This one hasn't shown up at all in the Trunk data since 2002010906, so it won't
be in M098. Marking WFM.
Status: NEW → RESOLVED
Last Resolved: 17 years ago
Resolution: --- → WORKSFORME

Comment 8

17 years ago
Marking verified.
Status: RESOLVED → VERIFIED
Crash Signature: [@ _hashFreeEntry]
Keywords: qawanted
You need to log in before you can comment on or make changes to this bug.