631894 - Spike in crashes [@ PL_DHashTableOperate ]

Status: RESOLVED DUPLICATE of bug 630193

(Core :: XPCOM, defect)

Description

[Scoobidiver (away)]

It is a residual crash signature in 3.0, 3.6 and the trunk, but from 4.0b10, there is a spike in crashes.
It is #12 top crasher in 4.0b10 over the last week.
There are no clear correlations with a particular extension, contrarily to bug 607305.

The stack trace is basic:
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	PL_DHashTableOperate 	obj-firefox/xpcom/build/pldhash.c:615

Crash adresses are: 0x8..0x13, 0x18, 0x21..0x24 and more.

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=PL_DHashTableOperate

Comment 1

[Sheila Mooney]

So there are about 2000 of these on Beta10 over the course of a week. It's sitting about #10. I think it's worthy of some level of investigation.

Comment 2

[Benjamin Smedberg]

 	xul.dll!PL_DHashTableOperate(table=0x0dc15640, key=0x0040cbe8, op=PL_DHASH_ADD)  Line 615	C
 	xul.dll!nsTHashtable<nsBaseHashtableET<nsPtrHashKey<void const >,nsRefPtr<nsAccessible> > >::PutEntry(aKey=0x0040cbe8)  Line 189	C++
 	xul.dll!nsBaseHashtable<nsStringHashKey,int,int>::Put(aKey={...}, aData=0x6885851c)  Line 165	C++
 	xul.dll!nsGlobalWindow::Observe(aSubject=, aTopic=0x00000000, aData=) 	C++
 	mozsqlite3.dll!winMutexLeave(p=0x00510040)  Line 17431	C
 	mozcrt19.dll!arena_malloc_small(arena=0x0c265700, size=0x00000000, zero=0x0c265840)  Line 3786	C
 	xul.dll!nsTArray_base<nsTArrayDefaultAllocator>::ShiftData(start=0x00000000, oldLen=0x00000000, newLen=0x00000000, elemSize=0x00000008)  Line 169	C++
 	xul.dll!nsObserverList::FillObserverArray(aArray={...})  Line 119	C++
 	xul.dll!PL_DHashTableOperate(table=0x00000000, key=0x00000000, op=0x10371be0)  Line 625	C
 	xul.dll!nsObserverService::NotifyObservers(aSubject=0x10371be0, aTopic=0x6901da58, someData=0x0040cd98)  Line 182	C++
>	xul.dll!nsDOMStorage::BroadcastChangeNotification(aKey={...}, aOldValue={...}, aNewValue={...})  Line 1774	C++
 	xul.dll!nsDOMStorage::SetItem(aKey={...}, aData={...})  Line 1633	C++
 	xul.dll!nsStorageSH::SetProperty(wrapper=0x10371be0, cx=0x0b556b60, obj=0x1dfb3dc8, id=0x083a4340, vp=0x0040cfd0, _retval=0x0040ceb4)  Line 10325	C++
 	xul.dll!XPC_WN_Helper_SetProperty(cx=0x0b556b60, obj=0x00000001, id=0x083a4340, vp=0x0040cfd0)  Line 987	C++
 	mozjs.dll!js::Shape::set(cx=0x0b556b60, obj=0x00000000, vp=0x00000000)  Line 275	C++
 	mozjs.dll!js_NativeSet(cx=0x00000000, obj=0x00000000, shape=0x00000001, added=false, vp=0x00000000)  Line 5199	C++
 	mozjs.dll!js_SetPropertyHelper(cx=0x00000000, obj=, id=, defineHow=, vp=, strict=)  Line 5674	C++
 	mozjs.dll!js_SetProperty(cx=0x0b556b60, obj=0x1dfb3dc8, id=0x083a4340, vp=0x0040cfd0, strict=0x00000000)  Line 5685	C++
 	mozjs.dll!js::mjit::stubs::SetElem<0>(f={...})  Line 591	C++

I believe the topcrash here is just 630193 under a different guise.