1256044 - crash in PLDHashTable::Search | nsInterfaceHashtable<T>::Get (from IndexedDB caller)

Status: RESOLVED DUPLICATE of bug 1195149

(Core :: Storage: IndexedDB, defect)

Description

[Mats Palmgren (inactive)]

This bug was filed from the Socorro interface and is 
report bp-4e744ae5-6291-4f6b-b9ad-12d842160310.
=============================================================

About 1500 reported crash incidents in the past 28 days, all on Windows it seems:
Operating System 	Percentage 	Number Of Crashes
Windows 7 	45.66% 	662
Windows 10 	30.97% 	449
Windows 8.1 	14.97% 	217
Windows XP 	5.52% 	80
Windows 8 	2.69% 	39
Windows Vista 	0.21% 	3

It looks like a null-pointer crash:
 x86 	EXCEPTION_ACCESS_VIOLATION_READ 	0x1c
amd64 	EXCEPTION_ACCESS_VIOLATION_READ 	0x28 

The handful of crashes with other addresses have non-IndexDB stacks.

Stack:
PLDHashTable::Search(void const*)
nsInterfaceHashtable<nsCStringHashKey, mozIStorageStatement>::Get(nsACString_internal const&, mozIStorageStatement**)
mozilla::dom::indexedDB::`anonymous namespace'::DatabaseConnection::GetCachedStatement(nsACString_internal const&, mozilla::dom::indexedDB::A0x0e6b8872::DatabaseConnection::CachedStatement*)
mozilla::dom::indexedDB::`anonymous namespace'::DatabaseConnection::GetFreelistCount(mozilla::dom::indexedDB::A0x0e6b8872::DatabaseConnection::CachedStatement&, unsigned int*)
mozilla::dom::indexedDB::`anonymous namespace'::DatabaseConnection::DoIdleProcessing(bool)
mozilla::dom::indexedDB::`anonymous namespace'::ConnectionPool::IdleConnectionRunnable::Run()
nsThread::ProcessNextEvent(bool, bool*)
NS_ProcessNextEvent(nsIThread*, bool)
mozilla::dom::indexedDB::`anonymous namespace'::ConnectionPool::ThreadRunnable::Run()
nsThread::ProcessNextEvent(bool, bool*)
NS_ProcessNextEvent(nsIThread*, bool)
[...]


More Crash Reports:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=PLDHashTable%3A%3ASearch+%7C+nsInterfaceHashtable%3CT%3E%3A%3AGet