1911932 - Crash in [@ detail::nsTHashtableEntryIterator<T>::operator++]

Status: ASSIGNED

(Toolkit :: Safe Browsing, defect, P2)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/25d98c97-1a1b-4c35-bc7b-34f2e0240803

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  detail::nsTHashtableEntryIterator<const nsBaseHashtableET<nsIntegralHashKey<unsigned int, 0>, mozilla::UniquePtr<mozilla::safebrowsing::VLPrefixSet::PrefixString, mozilla::DefaultDelete<mozilla::safebrowsing::VLPrefixSet::PrefixString> > > >::operator++  xpcom/ds/nsTHashtable.h:100
0  xul.dll  mozilla::safebrowsing::VLPrefixSet::GetSmallestPrefix const  toolkit/components/url-classifier/LookupCacheV4.cpp:544
1  xul.dll  mozilla::safebrowsing::LookupCacheV4::ApplyUpdate  toolkit/components/url-classifier/LookupCacheV4.cpp:352
2  xul.dll  mozilla::safebrowsing::Classifier::UpdateTableV4  toolkit/components/url-classifier/Classifier.cpp:1452
3  xul.dll  mozilla::safebrowsing::Classifier::ApplyUpdatesBackground  toolkit/components/url-classifier/Classifier.cpp:844
4  xul.dll  mozilla::safebrowsing::Classifier::AsyncApplyUpdates::<lambda_4>::operator  toolkit/components/url-classifier/Classifier.cpp:747
4  xul.dll  mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/toolkit/components/url-classifier/Classifier.cpp:735:7'>::Run  xpcom/threads/nsThreadUtils.h:548
5  xul.dll  mozilla::TaskQueue::Runner::Run  xpcom/threads/TaskQueue.cpp:257
6  xul.dll  nsThreadPool::Run  xpcom/threads/nsThreadPool.cpp:456
7  xul.dll  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1198

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-05-31
• Process type: Parent
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 3 out of 14 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:dimi, could you have a look please?

For more information, please visit BugBot documentation.

Comment 2

[Tim Huang[:timhuang]]

Attachment: Bug 1911932 - Move the ApplyUpdate() in Classifier::UpdateTableV4() to verify the issue. r?dimi!

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6b50a7c314e4
Move the ApplyUpdate() in Classifier::UpdateTableV4() to verify the issue. r=dimi

Comment 4

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/6b50a7c314e4

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:dimi, could you have a look please?

For more information, please visit BugBot documentation.