344117 - crash on shutdown when updating to most-recent Bon Echo nightly [@ SearchTable] [@ PL_DHashTableOperate] [@ nsGenericDOMDataNode::~nsGenericDOMDataNode]

Status: VERIFIED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Adam Guthrie]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1b1) Gecko/20060709 BonEcho/2.0b1

I was probably actually using an older build when the shutdown crash occured. Anyway...

Steps to reproduce:
1. Turn auto updates on. 
2. Autoupdate to the most recent Bon Echo nightly and choose "Restart and Apply Updates".

This is where I crash.

Incident ID: 20788344
Stack Signature	SearchTable() 79c1ec88
Product ID	Firefox2
Build ID	2006070806
Trigger Time	2006-07-10 09:18:08.0
Platform	MacOSX
Operating System	Darwin 8.7.0
Module	libxpcom_core.dylib.1.0.0 + (00001054)
URL visited	
User Comments	ispiked - applying update to bon echo nightly
Since Last Crash	135818 sec
Total Uptime	135818 sec
Trigger Reason	SIGSEGV: Segmentation Violation: (signal 11)
Source File, Line No.	/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/xpcom/build/pldhash.c, line 414
Stack Trace 	
SearchTable()   PL_DHashTableOperate()   nsGenericDOMDataNode::~nsGenericDOMDataNode()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/base/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/base/src/nsGenericDOMDataNode.cpp, line 73]
nsTextNode::~nsTextNode()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/base/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/base/src/nsTextNode.cpp, line 153]
nsGenericDOMDataNode::Release()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/base/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/base/src/nsGenericDOMDataNode.cpp, line 94]
nsAttrAndChildArray::Clear()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/base/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/base/src/nsAttrAndChildArray.cpp, line 618]
nsAttrAndChildArray::~nsAttrAndChildArray()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/base/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/base/src/nsAttrAndChildArray.cpp, line 126]
nsGenericElement::~nsGenericElement()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/extensions/transformiix/source/xslt/util//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/db/sqlite3/src/pragma.c, line 99]
nsHTMLPreElement::~nsHTMLPreElement()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/html/content/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/html/content/src/nsHTMLPreElement.cpp, line 91]
nsGenericElement::Release()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/extensions/transformiix/source/xslt/util//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/db/sqlite3/src/pragma.c, line 3677]
nsAttrAndChildArray::Clear()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/base/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/base/src/nsAttrAndChildArray.cpp, line 618]
nsAttrAndChildArray::~nsAttrAndChildArray()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/base/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/base/src/nsAttrAndChildArray.cpp, line 126]
nsGenericElement::~nsGenericElement()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/extensions/transformiix/source/xslt/util//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/db/sqlite3/src/pragma.c, line 99]
nsHTMLBodyElement::~nsHTMLBodyElement()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/extensions/transformiix/source/xslt/util//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/db/sqlite3/src/pragma.c, line 293]
nsGenericElement::Release()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/extensions/transformiix/source/xslt/util//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/db/sqlite3/src/pragma.c, line 3677]
nsCOMPtr_base::assign_from_qi()   nsRange::DoSetRange()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/base/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/base/src/nsRange.cpp, line 830]
nsRange::~nsRange()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/base/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/base/src/nsRange.cpp, line 150]
nsRange::Release()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/content/base/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/content/base/src/nsRange.cpp, line 448]
nsTypeAheadFind::~nsTypeAheadFind()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/toolkit/components/typeaheadfind/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/toolkit/components/typeaheadfind/src/nsTypeAheadFin]
nsTypeAheadFind::Release()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/toolkit/components/typeaheadfind/src//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/toolkit/components/typeaheadfind/src/nsTypeAheadFind.cpp, li]
nsPrefBranch::freeObserverList()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/extensions/transformiix/source/xslt/util//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/db/sqlite3/src/pragma.c, line 787]
nsPrefBranch::Observe()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/extensions/transformiix/source/xslt/util//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/db/sqlite3/src/pragma.c, line 730]
nsObserverService::NotifyObservers()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/xpcom/ds//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/xpcom/ds/nsObserverService.cpp, line 848]
NS_ShutdownXPCOM_P()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/xpcom/build//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/xpcom/build/nsXPComInit.cpp, line 806]
ScopedXPCOMStartup::~ScopedXPCOMStartup()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/toolkit/xre//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 554]
XRE_main()  [/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/toolkit/xre//builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 2416]
_start()   start()

Comment 1

[Adam Guthrie]

Attachment: Mac crashlog

Comment 2

[Adam Guthrie]

This is showing up as the #8 topcrash for Firefox 2 Branch in Talkback.

Comment 3

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

I've been seeing this same stack for crash-on-quit with Camino 1.8branch builds, too (it's #2 and #4 in Camino 1.8branch topcrashers).  No apparent discernable pattern, unfortunately; it seems to happen *more often* (but not always) when I've left a number of tabs open overnight and quit to update to the next nightly, but sometimes I'll go several days without seeing it.

Comment 4

[WADA:World Anti-bad-Duping Agency]

> Source File, Line No.  
/builds/tinderbox/Fx-Mozilla1.8/Darwin_8.7.0_Depend/build/unifox/ppc/xpcom/build/pldhash.c,
line 414
> Stack Trace     
> SearchTable()   PL_DHashTableOperate()

Looks to be similar crash in PL_DHashTableOperate on MS Win when https: access with "Ad Muncher" or "Keiro Personal Firewal 4.2.2".
  Bug 333540(MS Win, Keiro Personal Firewall 4.2.2)
  Bug 338767(MS Win)
  Bug 342646(MS Win, AD Muncher)
See Bug 342646 Comment #4 and dependency tree of Bug 342646. 
What firewall or proxy software is used?

Comment 5

[Benjamin Smedberg]

Is this showing up on trunk? Possibly fixed by bug 331117.

Comment 6

[Adam Guthrie]

I haven't seen this crash for at least a couple of weeks, and Talkback has seen a drop, too. Last crash for SearchTable in Firefox2 was on the July 31st and the crashes are occurring a lot less frequently.

Smokey, if you agree, please mark this as WORKSFORME.

Comment 7

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Yeah, I haven't seen this for ages personally, and all the Camino SearchTable stacks dried up by mid-July (there are still a few PL_DHashTable crashes, but they have different stacks entirely).

Comment 8

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

I just saw this stack again when quitting yesterday's Camino 18branch (2006-08-24-04) nightly this morning :(  

There are one or two other recent Camino reports (but most recent Camino crashes-on-quit are the stack in bug 349463).

Not sure what to do here....

Comment 9

[Adam Guthrie]

I think dbaron's patch in bug 350930 might've taken care of the other crashes people were seeing.