1916079 - Startup crash in [@ nsLanguageAtomService::GetLanguageGroup]

Status: NEW

(Core :: Internationalization, defect, P3)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/c4c1beee-b1ba-4ce8-bf3f-d17ec0240826

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(!HasEntry())

Top 10 frames of crashing thread:

0  libxul.so  nsTHashtable<nsBaseHashtableET<nsAtomHashKey, nsStaticAtom*> >::EntryHandle::InsertInternal<nsStaticAtom*>  xpcom/ds/nsTHashtable.h:414
0  libxul.so  nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::EntryHandle::Insert<nsStaticAtom*>  xpcom/ds/nsBaseHashtable.h:695
0  libxul.so  nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::EntryHandle::OrInsertWith<nsLanguageAtomService::GetLanguageGroup  xpcom/ds/nsBaseHashtable.h:726
0  libxul.so  nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::LookupOrInsertWith<nsLanguageAtomService::GetLanguageGroup const  xpcom/ds/nsBaseHashtable.h:423
0  libxul.so  nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::WithEntryHandle<nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::LookupOrInsertWith<nsLanguageAtomService::GetLanguageGroup const  xpcom/ds/nsBaseHashtable.h:836
0  libxul.so  nsTHashtable<nsBaseHashtableET<nsAtomHashKey, nsStaticAtom*> >::WithEntryHandle<nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::WithEntryHandle<nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::LookupOrInsertWith<nsLanguageAtomService::GetLanguageGroup const  xpcom/ds/nsTHashtable.h:437
0  libxul.so  PLDHashTable::WithEntryHandle<nsTHashtable<nsBaseHashtableET<nsAtomHashKey, nsStaticAtom*> >::WithEntryHandle<nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::WithEntryHandle<nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::LookupOrInsertWith<nsLanguageAtomService::GetLanguageGroup  xpcom/ds/PLDHashTable.h:605
0  libxul.so  nsTHashtable<nsBaseHashtableET<nsAtomHashKey, nsStaticAtom*> >::WithEntryHandle<nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::WithEntryHandle<nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::LookupOrInsertWith<nsLanguageAtomService::GetLanguageGroup  xpcom/ds/nsTHashtable.h:434
0  libxul.so  nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::WithEntryHandle<nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::LookupOrInsertWith<nsLanguageAtomService::GetLanguageGroup  xpcom/ds/nsBaseHashtable.h:834
0  libxul.so  nsBaseHashtable<nsAtomHashKey, nsStaticAtom*, nsStaticAtom*, nsDefaultConverter<nsStaticAtom*, nsStaticAtom*> >::LookupOrInsertWith<nsLanguageAtomService::GetLanguageGroup  xpcom/ds/nsBaseHashtable.h:422

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-08-26
• Process type: Parent
• Is startup crash: Yes - 1 out of 2 crashes happened during startup
• Has user comments: No
• Is null crash: Yes - all crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::XPCOM' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:m_kato, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[Makoto Kato [:m_kato]]

This crash signature is 1 crash only. It might be a heap corruption by another issue?