382801 - Random crash [@0xfffeff20][__CFDictionaryFindBuckets1b]

Status: RESOLVED FIXED

(Camino Graveyard :: General, defect)

Description

[philippe (part-time)]

Attachment: crash log

Random crashes in the past 24 hours, 5 in total.
Unfortunately, not much STR at the moment.

The first crash log is dated  2007-05-31 16:27:43.217 +0900 (Japan Standard Time). That was with a home-made build made shortly after Stuart landed a couple of patches: bug 380465 (and bug 378544, bug 177941). Also from my notes, the patch for bug 373122.

Attached crash log is with the 2007053118 (2.0a1pre) Tinderbox build.
That crash happened just after/while I was bringing Mail.app forward.
Judging from my recent history: a couple of news sites(BBC, ElPais.com), some forums, nothing very special.

Comment 1

[philippe (part-time)]

clarification: Stuart didn't land bug 373122, but it was one of the recent fixes when I made that build.

Comment 2

[philippe (part-time)]

Attachment: another crash log

This one is slightly different, I think it happened shortly after I logged in Gmail somewhere earlier in the evening.

Comment 3

[Samuel Sidler (old account; do not CC)]

Steven, is this something bug 373122 could have caused?

Comment 4

[Stuart Morgan]

Sounds like a regression from my keychain change in bug 177941. Can you try running this with zombies enabled and seeing what shows up?

Comment 5

[philippe (part-time)]

I still don't have clear steps to reproduce, but 2 crashes that happened yesterday both happened after login/logout of Gmail.
For one of them: In Gmail, I followed a link from a 'Updated topic notification' message for a forum where I'm a regular. I logged out of gmail, went to the forum tab and 'Boom' (I wasn't logged in at that forum).
Of course, next I tried the same steps again, and everything went fine. :-(.

(In reply to comment #4)
> Sounds like a regression from my keychain change in bug 177941. Can you try
> running this with zombies enabled and seeing what shows up?
> 
Now running with those.

Comment 6

[philippe (part-time)]

[06/04-08:57][pikun:~]
  $ MallocScribble=1 MallocPreScribble=1 MallocGuardEdges=1 NSZombieEnabled=YES /Applications/Camino.app/Contents/MacOS/Camino
Camino(1243) malloc: protecting edges
Camino(1243) malloc: enabling scribbling to detect mods to free blocks
2007-06-04 08:57:42.585 Camino[1243] ChimericalConsole loaded
Bus error
[06/04-10:02][pikun:~]

recent history leading to crash:
Buzilla.m.o (logged in) - browse through list of newly filed bugs/comment in (this) bug (@9.34a.m local time)/check some other bug reports/log out
in another tab: mozillazine forums, not logged in, browse around Camino forums.

Comment 7

[Stuart Morgan]

(In reply to comment #6)
> Bus error

Can you attach the crash log from that?

>   $ MallocScribble=1 MallocPreScribble=1 MallocGuardEdges=1 NSZombieEnabled=YES

Also, try without the various malloc options, and use just NSZombieEnabled=YES.

(Please do remove ChimericalConsole for repro'ing, by the way; it's exceedingly unlikely to be related, but best to test with a clean instance of Camino.)

Comment 8

[philippe (part-time)]

Attachment: crash log 3

(per comment 7)
Ok, next crash (just at the time you replying in comment 7...)
with Build 2007060317 (2.0a1pre)

Same output to console as comment 6: 'Bus Error'
Build had been up for 4 hours (including 2 hours sleep).
3 tabs with pages from bugs.webkit.org (not logged in).

I'll test next with NSZombieEnabled=YES only, and ChimericalConsole removed.

Comment 9

[philippe (part-time)]

[06/04-14:31][pikun:~]
  $ NSZombieEnabled=YES /Applications/Camino.app/Contents/MacOS/Camino
2007-06-04 15:11:54.446 Camino[1524] error in CoreDragDispose: -1850
2007-06-04 20:22:13.001 Camino[1524] Looked for URLs on the pasteboard, but found none.
2007-06-04 20:22:13.063 Camino[1524] error in CoreDragDispose: -1850
Bus error
[06/04-22:56][pikun:~]

The crash occurred while logged in at the mozillazine forums and answering a post (typing in textarea).

Comment 10

[philippe (part-time)]

Attachment: crash log 4

crash in comment 9

Comment 11

[Stuart Morgan]

Attachment: probable fix

Ah, I think I see the problem; the key's lifetime is bound to the timer, which is invalidated before other operations on the key. Certainly this change needs to happen even if it's not the source of the crash, but I'd bet it is.

Josh, since this is very simple, could you r/sr it?

Comment 12

[Stuart Morgan]

(This would also explain why NSZombieEnabled isn't showing anything, since NSString falls through the cracks thanks to toll-free bridging.)

Comment 13

[Stuart Morgan]

Checked in on trunk and MOZILLA_1_8_BRANCH. Please re-open if you still see crashes in builds with this change.

Comment 14

[philippe (part-time)]

Thanks, Stuart.
Testing 2007060416 (2.0a1pre). So far, it is holding well here. Cross fingers.

Comment 15

[Stuart Morgan]

Thanks for serving as our early-warning system yet again ;)