1859974 - Crash in [@ nsTBaseHashSet<T>::Remove]

Status: RESOLVED DUPLICATE of bug 1859825

(Core :: Graphics: WebGPU, defect)

Description

[Calixte Denizet (:calixte)]

Crash report: https://crash-stats.mozilla.org/report/index/2d74a5d3-6364-48d5-ab96-ff6500231017

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  PLDHashTable::EntryStore::IsAllocated const  xpcom/ds/PLDHashTable.h:327
0  libxul.so  PLDHashTable::Remove  xpcom/ds/PLDHashTable.cpp:531
1  libxul.so  nsTHashtable<detail::VoidPtrHashKey>::RemoveEntry  xpcom/ds/nsTHashtable.h:346
1  libxul.so  nsTHashtable<nsPtrHashKey<mozilla::webgpu::Buffer> >::RemoveEntry  xpcom/ds/nsTHashtable.h:825
1  libxul.so  nsTBaseHashSet<nsPtrHashKey<mozilla::webgpu::Buffer> >::Remove  xpcom/ds/nsTHashSet.h:117
1  libxul.so  mozilla::webgpu::Device::UntrackBuffer  dom/webgpu/Device.cpp:102
1  libxul.so  mozilla::webgpu::Buffer::Drop  dom/webgpu/Buffer.cpp:153
2  libxul.so  mozilla::webgpu::Buffer::~Buffer  dom/webgpu/Buffer.cpp:54
3  libxul.so  mozilla::webgpu::Buffer::DeleteCycleCollectable  dom/webgpu/Buffer.h:44
3  libxul.so  mozilla::webgpu::Buffer::cycleCollection::DeleteCycleCollectable  dom/webgpu/Buffer.h:44

There are 10 crashes (from 3 installations) in nightly 120 starting with buildid 20231017095050. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1838693.

[1] https://hg.mozilla.org/mozilla-central/rev?node=41d7ed93df76

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1838693

Comment 2

[Brad Werth [:bradwerth]]

Testcase in Bug 1859825.