350930 - crashes [@ SearchTable]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

There have been continued crashes in pldhash code (in SearchTable) following the fix for bug 334177.  Some of the user comments mention shutdown; some don't.  The only theory I have so far is that they're all shutdown crashes, but some of the users got confused when reporting.  (I think I've seen that before for crashes that were clearly shutdown crashes by the stack.)

The talkback incidents all look pretty much like this:

Incident ID: 22723409
Stack Signature	SearchTable 69be2923
Product ID	Firefox2
Build ID	2006082101
Trigger Time	2006-08-31 03:05:45.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	xpcom_core.dll + (0000147a)
URL visited	
User Comments	
Since Last Crash	477 sec
Total Uptime	477 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/xpcom/build/pldhash.c, line 414
Stack Trace 	
SearchTable  [mozilla/xpcom/build/pldhash.c, line 414]
PL_DHashTableOperate  [mozilla/xpcom/build/pldhash.c, line 557]
nsGenericDOMDataNode::~nsGenericDOMDataNode  [mozilla/content/base/src/nsGenericDOMDataNode.cpp, line 72]
nsTextNode::`scalar deleting destructor'

My one theory so far is that I'm forgetting to set the ops pointer to null after destroying the hash table -- a regression from some of my leak fixes, I think.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: trunk patch

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: branch patch

This is a really trivial patch -- it nulls out a pointer that we null check before accessing the objects that we're destroying here.  I'm not sure that it's the cause of these crashes, but it could cause crashes (for a text node that's in the range list hash but not the event listener manager hash).

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Hrm.  I think I should have used bug 330683 instead of filing this duplicate, but at this point I'll leave it separate in case it doesn't fix the crashes in talkback.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fixed on trunk.

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 236323 [details] [diff] [review]
branch patch

a=beltzner on behalf of 181drivers

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Checked in to MOZILLA_1_8_BRANCH.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Have not seen any reports on branch talkback (Firefox2) since checkin.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 330683 has been marked as a duplicate of this bug. ***