1396374 - Crash in PtrToNodeMatchEntry

Status: RESOLVED DUPLICATE of bug 1296631

(Core :: XPCOM, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-518934ea-04a1-49a4-a4be-cf94d0170902.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	PtrToNodeMatchEntry 	xpcom/base/nsCycleCollector.cpp:811
1 	xul.dll 	PLDHashTable::Add(void const*, mozilla::fallible_t const&) 	xpcom/ds/PLDHashTable.cpp:582
2 	xul.dll 	TraversalTracer::onChild(JS::GCCellPtr const&) 	xpcom/base/CycleCollectedJSRuntime.cpp:424
3 	xul.dll 	JS::CallbackTracer::onObjectEdge(JSObject**) 	obj-firefox/dist/include/js/TracingAPI.h:145
4 	xul.dll 	js::DispatchTyped<DoCallbackFunctor<JS::Value>, JS::CallbackTracer*&, char const*&>(DoCallbackFunctor<JS::Value>, JS::Value const&, JS::CallbackTracer*&, char const*&) 	obj-firefox/dist/include/js/Value.h:1444
5 	xul.dll 	DoCallback<JS::Value>(JS::CallbackTracer*, JS::Value*, char const*) 	js/src/gc/Tracer.cpp:69
6 	xul.dll 	DoCallback<JS::Value>(JS::CallbackTracer*, JS::Value*, char const*) 	js/src/gc/Tracer.cpp:69
7 	xul.dll 	DispatchToTracer<JS::Value>(JSTracer*, JS::Value*, char const*) 	js/src/gc/Marking.cpp:690
8 	xul.dll 	JSObject::traceChildren(JSTracer*) 	js/src/jsobj.cpp:3952
9 	xul.dll 	mozilla::CycleCollectedJSRuntime::NoteGCThingJSChildren(JS::GCCellPtr, nsCycleCollectionTraversalCallback&) 	xpcom/base/CycleCollectedJSRuntime.cpp:653
10 	xul.dll 	mozilla::JSGCThingParticipant::TraverseNative(void*, nsCycleCollectionTraversalCallback&) 	xpcom/base/CycleCollectedJSRuntime.cpp:370
11 	xul.dll 	JS::Value::toGCCellPtr() 	obj-firefox/dist/include/js/Value.h:673
12 	xul.dll 	nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) 	xpcom/base/nsCycleCollector.cpp:3675

crashes with this signature are significantly regressing in volume on firefox in the 56.0 cycle. this is a graph of how the signature is developing on the beta channel:
https://crash-stats.mozilla.com/signature/?product=Firefox&release_channel=beta&_sort=-date&signature=PtrToNodeMatchEntry&date=>%3D2017-05-01T00%3A00%3A00.000Z#graphs

those frequent crashes seem to have started on 56.0a1 build 20170720030203 - this would be its pushlog to the day before: https://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2017-07-19&tochange=0985725c848ec0cfc6f2f3c3a5aa3d71321e7620

Comment 1

[Liz Henry (:lizzard) (relman/hg->git project)]

Nathan, can you help find someone to investigate? Looks like this crash is getting worse in beta.

Comment 2

[Andrew McCreight [:mccr8]]

These CC crashes have been around forever. This is probably due to bug 1382343 (or another of Ehsan's hash changes), but I'm guessing this is just a signature change.

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

In the duplicate, this is marked fix-optional (as an unactionable OOM crash)