354195 - Crash in [@nsTHashtable<nsISupportsHashKey>::s_ClearEntry] [@nsDocument::DestroyLinkMap]

Status: RESOLVED INCOMPLETE

(Core :: DOM: Core & HTML, defect)

Description

[Reinout van Schouwen]

We've had several Epiphany crash reports that occur in nsHashtable that we couldn't find back in Mozilla bugzilla.

Copying the stacktrace from http://bugzilla.gnome.org/show_bug.cgi?id=353252 below:

Memory status: size: 158973952 vsize: 0 resident: 158973952 share: 0 rss:
74678272 rss_rlim: 0
CPU usage: start_time: 1156769349 rtime: 0 utime: 39756 stime: 0 cutime:38539
cstime: 0 timeout: 1217 it_real_value: 0 frequency: 0

Backtrace was generated from '/usr/bin/epiphany'

Using host libthread_db library "/lib/i686/libthread_db.so.1".
`shared object read from target memory' has disappeared; keeping its symbols.
[Thread debugging using libthread_db enabled]
[New Thread -1229420320 (LWP 13348)]
[New Thread -1332741216 (LWP 22004)]
[New Thread -1296335968 (LWP 22003)]
[New Thread -1319113824 (LWP 22002)]
[New Thread -1279550560 (LWP 22001)]
[New Thread -1287943264 (LWP 21994)]
[New Thread -1261933664 (LWP 13358)]
[New Thread -1242625120 (LWP 13353)]
0xbfffe410 in __kernel_vsyscall ()
#0  0xbfffe410 in __kernel_vsyscall ()
#1  0xb6f982cb in __waitpid_nocancel () from /lib/i686/libpthread.so.0
#2  0xb7e88577 in libgnomeui_segv_handle (signum=11) at gnome-ui-init.c:867
#3  0xb7f940c0 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:210
#4  <signal handler called>
#5  0xb6cc8bee in ~nsCOMPtr_base (this=) at nsCOMPtr.cpp:81
#6  0xb509891b in nsTHashtable<nsISupportsHashKey>::s_ClearEntry (
    table=0x8ac8248, entry=0x90f1508) at ../dist/include/xpcom/nsCOMPtr.h:923
#7  0xb6cc8079 in PL_DHashTableFinish (table=0x8ac8248) at pldhash.c:345
#8  0xb5098de2 in ~nsTHashtable (this=0x8ac8248)
    at ../dist/include/xpcom/nsTHashtable.h:315
#9  0xb508a951 in nsUint32ToContentHashEntry::Destroy (this=0x8b3bd90)
    at nsDocument.cpp:159
#10 0xb5098dff in nsTHashtable<nsUint32ToContentHashEntry>::s_ClearEntry (
    table=0x9008718, entry=0x8b3bd90) at nsDocument.h:137
#11 0xb6cc8236 in PL_DHashTableRawRemove (table=0x9008718, entry=0x8b3bd90)
    at pldhash.c:592
#12 0xb6cc8497 in PL_DHashTableEnumerate (table=0x9008718, 
    etor=0xb6ccb670 <PL_DHashStubEnumRemove(PLDHashTable*, PLDHashEntryHdr*,
unsigned int, void*)>, arg=0x0) at pldhash.c:624
#13 0xb5088ce6 in nsDocument::DestroyLinkMap (this=0x9008548)
    at ../dist/include/xpcom/nsTHashtable.h:248
#14 0xb509409f in nsDocument::Destroy (this=0x9008548) at nsDocument.cpp:4908
#15 0xb4ec6682 in DocumentViewerImpl::Close (this=0x8a61778, aSHEntry=0x0)
    at nsDocumentViewer.cpp:1285
#16 0xb552a561 in nsDocShell::Destroy (this=0x9c4ef28) at nsDocShell.cpp:3549
#17 0xb558d97c in nsWebBrowser::SetDocShell (this=0x8679000, aDocShell=0x0)
    at nsWebBrowser.cpp:1631
#18 0xb558920b in nsWebBrowser::InternalDestroy (this=0x8679000)
    at nsWebBrowser.cpp:142
#19 0xb558c7f9 in nsWebBrowser::Destroy (this=0x8679000)
    at nsWebBrowser.cpp:1237
#20 0xb7f8c0da in EmbedWindow::ReleaseChildren (this=0x9a7fa10)
    at EmbedWindow.cpp:113
#21 0xb7f8a899 in EmbedPrivate::Destroy (this=0x9bdc8d0)
    at EmbedPrivate.cpp:373
#22 0xb7f882f0 in gtk_moz_embed_destroy (object=0x884f920)
    at gtkmozembed2.cpp:555
#23 0x080be1a3 in mozilla_embed_destroy (object=0x884f920)
    at mozilla-embed.cpp:301
#24 0xb6f5b993 in IA__g_cclosure_marshal_VOID__VOID (closure=0x81779e8, 
    return_value=0x0, n_param_values=1, param_values=0xbf86b8ec, 
    invocation_hint=0xbf86b7fc, marshal_data=0x80be150) at gmarshal.c:77
#25 0xb6f4c76e in g_type_class_meta_marshal (closure=0x81779e8, 
    return_value=0x0, n_param_values=1, param_values=0xbf86b8ec, 
    invocation_hint=0xbf86b7fc, marshal_data=0x4c) at gclosure.c:567
#26 0xb6f4e39f in IA__g_closure_invoke (closure=0x81779e8, return_value=0x0, 
    n_param_values=1, param_values=0xbf86b8ec, invocation_hint=0xbf86b7fc)
    at gclosure.c:490
#27 0xb6f5ff32 in signal_emit_unlocked_R (node=0x8178030, detail=0, 
    instance=0x884f920, emission_return=0x0, instance_and_params=0xbf86b8ec)
    at gsignal.c:2554
#28 0xb6f60ca7 in IA__g_signal_emit_valist (instance=0x884f920, signal_id=2, 
    detail=0, var_args=) at gsignal.c:2197
#29 0xb6f60e4b in IA__g_signal_emit (instance=0x884f920, signal_id=2, 
    detail=0) at gsignal.c:2241
#30 0xb7abd8af in gtk_object_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#31 0xb7bbac23 in gtk_widget_hide () from /usr/lib/libgtk-x11-2.0.so.0
#32 0xb6f50a4f in IA__g_object_run_dispose (object=0x884f920) at gobject.c:571
#33 0xb7abd5bf in gtk_object_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#34 0xb7bbadf5 in gtk_widget_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#35 0xb79c3e6f in gtk_button_box_set_child_size ()
   from /usr/lib/libgtk-x11-2.0.so.0
#36 0xb7a0464c in gtk_container_foreach () from /usr/lib/libgtk-x11-2.0.so.0
#37 0xb7a04fbe in gtk_container_set_resize_mode ()
   from /usr/lib/libgtk-x11-2.0.so.0
#38 0xb6f5b993 in IA__g_cclosure_marshal_VOID__VOID (closure=0x81779e8, 
    return_value=0x0, n_param_values=1, param_values=0xbf86be5c, 
    invocation_hint=0xbf86bd6c, marshal_data=0xb7a04f80) at gmarshal.c:77
#39 0xb6f4c76e in g_type_class_meta_marshal (closure=0x81779e8, 
    return_value=0x0, n_param_values=1, param_values=0xbf86be5c, 
    invocation_hint=0xbf86bd6c, marshal_data=0x4c) at gclosure.c:567
#40 0xb6f4e39f in IA__g_closure_invoke (closure=0x81779e8, return_value=0x0, 
    n_param_values=1, param_values=0xbf86be5c, invocation_hint=0xbf86bd6c)
    at gclosure.c:490
#41 0xb6f5ff32 in signal_emit_unlocked_R (node=0x8178030, detail=0, 
    instance=0x86f2d08, emission_return=0x0, instance_and_params=0xbf86be5c)
    at gsignal.c:2554
#42 0xb6f60ca7 in IA__g_signal_emit_valist (instance=0x86f2d08, signal_id=2, 
    detail=0, var_args=) at gsignal.c:2197
#43 0xb6f60e4b in IA__g_signal_emit (instance=0x86f2d08, signal_id=2, 
    detail=0) at gsignal.c:2241
#44 0xb7abd8af in gtk_object_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#45 0xb7bbac23 in gtk_widget_hide () from /usr/lib/libgtk-x11-2.0.so.0
#46 0x0807fa32 in ephy_tab_dispose (object=0x86f2d08) at ephy-tab.c:826
#47 0xb6f50a4f in IA__g_object_run_dispose (object=0x86f2d08) at gobject.c:571
#48 0xb7abd5bf in gtk_object_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#49 0xb7bbadf5 in gtk_widget_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#50 0xb7ab5128 in gtk_notebook_popup_enable ()
   from /usr/lib/libgtk-x11-2.0.so.0
#51 0xb7a0464c in gtk_container_foreach () from /usr/lib/libgtk-x11-2.0.so.0
#52 0xb7a04fbe in gtk_container_set_resize_mode ()
   from /usr/lib/libgtk-x11-2.0.so.0
#53 0xb7abb9a8 in gtk_notebook_new () from /usr/lib/libgtk-x11-2.0.so.0
#54 0xb6f5b993 in IA__g_cclosure_marshal_VOID__VOID (closure=0x81779e8, 
    return_value=0x0, n_param_values=1, param_values=0xbf86c40c, 
    invocation_hint=0xbf86c31c, marshal_data=0xb7abb930) at gmarshal.c:77
#55 0xb6f4c76e in g_type_class_meta_marshal (closure=0x81779e8, 
    return_value=0x0, n_param_values=1, param_values=0xbf86c40c, 
    invocation_hint=0xbf86c31c, marshal_data=0x4c) at gclosure.c:567
#56 0xb6f4e39f in IA__g_closure_invoke (closure=0x81779e8, return_value=0x0, 
    n_param_values=1, param_values=0xbf86c40c, invocation_hint=0xbf86c31c)
    at gclosure.c:490
#57 0xb6f5ff32 in signal_emit_unlocked_R (node=0x8178030, detail=0, 
    instance=0x8398478, emission_return=0x0, instance_and_params=0xbf86c40c)
    at gsignal.c:2554
#58 0xb6f60ca7 in IA__g_signal_emit_valist (instance=0x8398478, signal_id=2, 
    detail=0, var_args=) at gsignal.c:2197
#59 0xb6f60e4b in IA__g_signal_emit (instance=0x8398478, signal_id=2, 
    detail=0) at gsignal.c:2241
#60 0xb7abd8af in gtk_object_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#61 0xb7bbac23 in gtk_widget_hide () from /usr/lib/libgtk-x11-2.0.so.0
#62 0xb6f50a4f in IA__g_object_run_dispose (object=0x8398478) at gobject.c:571
#63 0xb7abd5bf in gtk_object_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#64 0xb7bbadf5 in gtk_widget_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#65 0xb79c7b9d in gtk_box_pack_start_defaults ()
   from /usr/lib/libgtk-x11-2.0.so.0
#66 0xb7a0464c in gtk_container_foreach () from /usr/lib/libgtk-x11-2.0.so.0
#67 0xb7a04fbe in gtk_container_set_resize_mode ()
   from /usr/lib/libgtk-x11-2.0.so.0
#68 0xb6f5b993 in IA__g_cclosure_marshal_VOID__VOID (closure=0x81779e8, 
    return_value=0x0, n_param_values=1, param_values=0xbf86c97c, 
    invocation_hint=0xbf86c88c, marshal_data=0xb7a04f80) at gmarshal.c:77
#69 0xb6f4c76e in g_type_class_meta_marshal (closure=0x81779e8, 
    return_value=0x0, n_param_values=1, param_values=0xbf86c97c, 
    invocation_hint=0xbf86c88c, marshal_data=0x4c) at gclosure.c:567
#70 0xb6f4e39f in IA__g_closure_invoke (closure=0x81779e8, return_value=0x0, 
    n_param_values=1, param_values=0xbf86c97c, invocation_hint=0xbf86c88c)
    at gclosure.c:490
#71 0xb6f5ff32 in signal_emit_unlocked_R (node=0x8178030, detail=0, 
    instance=0x818db20, emission_return=0x0, instance_and_params=0xbf86c97c)
    at gsignal.c:2554
#72 0xb6f60ca7 in IA__g_signal_emit_valist (instance=0x818db20, signal_id=2, 
    detail=0, var_args=) at gsignal.c:2197
#73 0xb6f60e4b in IA__g_signal_emit (instance=0x818db20, signal_id=2, 
    detail=0) at gsignal.c:2241
#74 0xb7abd8af in gtk_object_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#75 0xb7bbac23 in gtk_widget_hide () from /usr/lib/libgtk-x11-2.0.so.0
#76 0xb6f50a4f in IA__g_object_run_dispose (object=0x818db20) at gobject.c:571
#77 0xb7abd5bf in gtk_object_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#78 0xb7bbadf5 in gtk_widget_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#79 0xb79c3e6f in gtk_button_box_set_child_size ()
   from /usr/lib/libgtk-x11-2.0.so.0
#80 0xb7a0464c in gtk_container_foreach () from /usr/lib/libgtk-x11-2.0.so.0
#81 0xb7a04fbe in gtk_container_set_resize_mode ()
   from /usr/lib/libgtk-x11-2.0.so.0
#82 0xb7bc9f9b in gtk_window_new () from /usr/lib/libgtk-x11-2.0.so.0
#83 0xb6f5b993 in IA__g_cclosure_marshal_VOID__VOID (closure=0x81779e8, 
    return_value=0x0, n_param_values=1, param_values=0xbf86cf0c, 
    invocation_hint=0xbf86ce1c, marshal_data=0xb7bc9f20) at gmarshal.c:77
#84 0xb6f4c76e in g_type_class_meta_marshal (closure=0x81779e8, 
    return_value=0x0, n_param_values=1, param_values=0xbf86cf0c, 
    invocation_hint=0xbf86ce1c, marshal_data=0x4c) at gclosure.c:567
#85 0xb6f4e2bb in IA__g_closure_invoke (closure=0x81779e8, return_value=0x0, 
    n_param_values=1, param_values=0xbf86cf0c, invocation_hint=0xbf86ce1c)
    at gclosure.c:490
#86 0xb6f5ff32 in signal_emit_unlocked_R (node=0x8178030, detail=0, 
    instance=0x8314230, emission_return=0x0, instance_and_params=0xbf86cf0c)
    at gsignal.c:2554
#87 0xb6f60ca7 in IA__g_signal_emit_valist (instance=0x8314230, signal_id=2, 
    detail=0, var_args=) at gsignal.c:2197
#88 0xb6f60e4b in IA__g_signal_emit (instance=0x8314230, signal_id=2, 
    detail=0) at gsignal.c:2241
#89 0xb7abd8af in gtk_object_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#90 0xb7bbac23 in gtk_widget_hide () from /usr/lib/libgtk-x11-2.0.so.0
#91 0xb7bc6ed2 in gtk_window_set_focus () from /usr/lib/libgtk-x11-2.0.so.0
#92 0x08087779 in ephy_window_dispose (object=0x8314230) at ephy-window.c:2715
#93 0xb6f50a4f in IA__g_object_run_dispose (object=0x8314230) at gobject.c:571
#94 0xb7abd5bf in gtk_object_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#95 0xb7bbadf5 in gtk_widget_destroy () from /usr/lib/libgtk-x11-2.0.so.0
#96 0xb7a9642e in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#97 0xb791b6f8 in gdk_add_client_message_filter ()
   from /usr/lib/libgdk-x11-2.0.so.0
#98 0xb6ed51e5 in IA__g_main_context_dispatch (context=0x8190a30)
    at gmain.c:2043
#99 0xb6ed8202 in g_main_context_iterate (context=0x8190a30, block=1, 
    dispatch=1, self=0x8173dc8) at gmain.c:2675
#100 0xb6ed8574 in IA__g_main_loop_run (loop=0x81a8ed0) at gmain.c:2879
#101 0xb7a9675f in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#102 0x08076fcd in main (argc=-1253495712, argv=0x114) at ephy-main.c:716

Thread 8 (Thread -1242625120 (LWP 13353)):
#0  0xbfffe410 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb6e316c3 in poll () from /lib/i686/libc.so.6
        ftw_arr = {0, 1, 2, 3, 0, 1, 3}
        nftw_arr = {0, 1, 2, 3, 4, 5, 6}
#2  0xb7f4edfb in PR_Poll (pds=0x87b5a88, npds=1, timeout=4294967295)
    at ptio.c:3877
No locals.
#3  0xb5f3681b in nsSocketTransportService::Poll (this=0x87b55a0, 
    interval=0xb5ef03f8) at nsSocketTransportService2.cpp:359
        pollList = (PRPollDesc *) 0x87b5a88
        pollCount = 1
        pollTimeout = 4294967295
        ts = 1430666381
        rv = 
Thread 7 (Thread -1261933664 (LWP 13358)):
#0  0xbfffe410 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb6f94a0c in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/i686/libpthread.so.0
No symbol table info available.
#2  0xb7f4c291 in pt_TimedWait (cv=0x871341c, ml=0x87133b8, timeout=)
    at ptsynch.c:280
        rv = 119015
        now = {tv_sec = 1156776870, tv_usec = 194354}
        tmo = {tv_sec = 1156776884, tv_nsec = 5354000}
        ticks = 
Thread 6 (Thread -1287943264 (LWP 21994)):
#0  0xbfffe410 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb6f94a0c in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/i686/libpthread.so.0
No symbol table info available.
#2  0xb7f4c291 in pt_TimedWait (cv=0x87b6ebc, ml=0x87b6df8, timeout=)
    at ptsynch.c:280
        rv = 189
        now = {tv_sec = 1156776819, tv_usec = 958785}
        tmo = {tv_sec = 1156776879, tv_nsec = 958785000}
        ticks = 
Thread 5 (Thread -1279550560 (LWP 22001)):
#0  0xbfffe410 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb6f94a0c in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/i686/libpthread.so.0
No symbol table info available.
#2  0xb7f4c291 in pt_TimedWait (cv=0x89c32e4, ml=0x89c34d0, timeout=)
    at ptsynch.c:280
        rv = 1090
        now = {tv_sec = 1156776862, tv_usec = 215988}
        tmo = {tv_sec = 1156776922, tv_nsec = 215988000}
        ticks = 
Thread 4 (Thread -1319113824 (LWP 22002)):
#0  0xbfffe410 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb6f94a0c in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/i686/libpthread.so.0
No symbol table info available.
#2  0xb7f4c291 in pt_TimedWait (cv=0x89c32e4, ml=0x89c34d0, timeout=)
    at ptsynch.c:280
        rv = 1088
        now = {tv_sec = 1156776862, tv_usec = 140490}
        tmo = {tv_sec = 1156776922, tv_nsec = 128490000}
        ticks = 
Thread 3 (Thread -1296335968 (LWP 22003)):
#0  0xbfffe410 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb6f94a0c in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/i686/libpthread.so.0
No symbol table info available.
#2  0xb7f4c291 in pt_TimedWait (cv=0x89c32e4, ml=0x89c34d0, timeout=)
    at ptsynch.c:280
        rv = 1092
        now = {tv_sec = 1156776862, tv_usec = 246167}
        tmo = {tv_sec = 1156776922, tv_nsec = 246167000}
        ticks = 
Thread 2 (Thread -1332741216 (LWP 22004)):
#0  0xbfffe410 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb6f94a0c in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/i686/libpthread.so.0
No symbol table info available.
#2  0xb7f4c291 in pt_TimedWait (cv=0x89c32e4, ml=0x89c34d0, timeout=)
    at ptsynch.c:280
        rv = 1087
        now = {tv_sec = 1156776862, tv_usec = 140482}
        tmo = {tv_sec = 1156776888, tv_nsec = 287482000}
        ticks = 
Thread 1 (Thread -1229420320 (LWP 13348)):
#0  0xbfffe410 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb6f982cb in __waitpid_nocancel () from /lib/i686/libpthread.so.0
No symbol table info available.
#2  0xb7e88577 in libgnomeui_segv_handle (signum=11) at gnome-ui-init.c:867
        estatus = -1208374096
        sa = {__sigaction_handler = {sa_handler = 0, sa_sigaction = 0}, 
  sa_mask = {__val = {1, 30338496, 145489592, 143197424, 56, 151351216, 
      3068716968, 3069793141, 3072201756, 40948, 16843040, 3053843240, 0, 
      3067596468, 3069737552, 3086704628, 3086598144, 3086598568, 3213275104, 
      3086654242, 3086598568, 3068764148, 3068768544, 143599008, 3213275128, 
      3067961139, 3068768544, 143599008, 3067596468, 3086592504, 143600856, 
      11}}, sa_flags = 8, sa_restorer = 0xb7fae9e0 <_dl_runtime_resolve+16>}
        pid =

Comment 1

[timeless]

please don't file gecko bugs in the embedding component. what matters is what's actually crashing (xpcom's the victim, embedding's the entrypoint, the crash is likely caused by someone in between).

very few if any people look at embedding, and it's not their job to redirect misdirected bugs. such bugs will likely get lost for months or years.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Related to Bug 78510 ?

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

TB22283379 or TB23629664