784253 - xpcshell orange: ASSERTION: op == PL_DHASH_LOOKUP || RECURSION_LEVEL(table) == 0, inside nsCacheService::DoomEntry_Internal

Status: RESOLVED WORKSFORME

(Core :: Networking: Cache, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I just saw a new xpcshell test failure:

https://tbpl.mozilla.org/php/getParsedLog.php?id=14547879&branch=mozilla-inbound

###!!! ASSERTION: op == PL_DHASH_LOOKUP || RECURSION_LEVEL(table) == 0: 'op == PL_DHASH_LOOKUP || RECURSION_LEVEL(table) == 0', file pldhash.cpp, line 573

PROCESS-CRASH | /home/cltbld/talos-slave/test/build/xpcshell/tests/netwerk/test/unit/test_bug652761.js | application crashed (minidump found)


This was between https://hg.mozilla.org/integration/mozilla-inbound/rev/cbb72643bbae and the backout https://hg.mozilla.org/integration/mozilla-inbound/rev/8e0ecc8a4f3e , so that could be the cause.

The stack makes the problem pretty clear:  see frame 2 and frame 7:  removing during enumeration is against pldhash's rules:


Thread 0 (crashed)
 0  libmozalloc.so!mozalloc_abort [mozalloc_abort.cpp : 23 + 0x0]
    rbx = 0xd3172d78   r12 = 0x5be28250   r13 = 0xd3172d78   r14 = 0x5be28250
    r15 = 0xc96bdfa7   rip = 0xcad4d08d   rsp = 0x5be28210   rbp = 0x5be28220
    Found by: given as instruction pointer in context
 1  libxul.so!NS_DebugBreak_P [nsDebugImpl.cpp : 423 + 0x4]
    rbx = 0x5be2ae1d   r12 = 0x5be28250   r13 = 0xd3172d78   r14 = 0x5be28250
    r15 = 0xc96bdfa7   rip = 0xc8bce221   rsp = 0x5be28230   rbp = 0x5be28680
    Found by: call frame info
 2  libxul.so!PL_DHashTableOperate [pldhash.cpp : 572 + 0x20]
    rbx = 0x01b7eed0   r12 = 0x00000002   r13 = 0x98015101   r14 = 0x98015100
    r15 = 0x98015180   rip = 0xc8b84247   rsp = 0x5be28690   rbp = 0x5be286b0
    Found by: call frame info
 3  libxul.so!nsCacheService::DoomEntry_Internal [nsCacheService.cpp : 2273 + 0xf]
    rbx = 0x980150f0   r12 = 0x01b7ee10   r13 = 0x98015101   r14 = 0x00000000
    r15 = 0x98015180   rip = 0xc7ca5ca5   rsp = 0x5be286c0   rbp = 0x5be286e0
    Found by: call frame info
 4  libxul.so!nsCacheEntryDescriptor::ClearCacheEntry [nsCacheEntryDescriptor.h : 55 + 0x10]
    rbx = 0x98015290   r12 = 0x5be286f0   r13 = 0x98015101   r14 = 0x00000000
    r15 = 0x98015180   rip = 0xc7c9db50   rsp = 0x5be286f0   rbp = 0x5be28730
    Found by: call frame info
 5  libxul.so!nsCacheEntry::DetachDescriptors [nsCacheEntry.cpp : 256 + 0x7]
    rbx = 0x98015290   r12 = 0x980150f0   r13 = 0x98015178   r14 = 0x00000000
    r15 = 0x98015180   rip = 0xc7c9dda7   rsp = 0x5be28740   rbp = 0x5be28770
    Found by: call frame info
 6  libxul.so!nsCacheService::DeactivateAndClearEntry [nsCacheService.cpp : 2871 + 0x7]
    rbx = 0x980150f0   r12 = 0x00000000   r13 = 0x00000200   r14 = 0x01c09370
    r15 = 0x00000000   rip = 0xc7ca6222   rsp = 0x5be28780   rbp = 0x5be28790
    Found by: call frame info
 7  libxul.so!PL_DHashTableEnumerate [pldhash.cpp : 715 + 0x17]
    rbx = 0x01b7eed0   r12 = 0x00000000   r13 = 0x00000200   r14 = 0x01c09370
    r15 = 0x00000000   rip = 0xc8b844e9   rsp = 0x5be287a0   rbp = 0x5be28800
    Found by: call frame info
 8  libxul.so!nsCacheService::ClearActiveEntries [nsCacheService.cpp : 2856 + 0x7]
    rbx = 0x01b7eed0   r12 = 0x00000000   r13 = 0x017a40f8   r14 = 0x017a40f8
    r15 = 0x5be28970   rip = 0xc7ca18e7   rsp = 0x5be28810   rbp = 0x5be28820
    Found by: call frame info
 9  libxul.so!nsCacheService::Shutdown [nsCacheService.cpp : 1196 + 0x7]
    rbx = 0x01b7ee10   r12 = 0x00000000   r13 = 0x017a40f8   r14 = 0x017a40f8
    r15 = 0x5be28970   rip = 0xc7ca69d2   rsp = 0x5be28830   rbp = 0x5be288a0
    Found by: call frame info
10  libxul.so!nsCacheProfilePrefObserver::Observe [nsCacheService.cpp : 386 + 0xa]
    rbx = 0x01c0b170   r12 = 0xc941db55   r13 = 0x017a40f8   r14 = 0x017a40f8
    r15 = 0x5be28970   rip = 0xc7ca6cf7   rsp = 0x5be288b0   rbp = 0x5be28960
    Found by: call frame info
11  libxul.so!nsObserverList::NotifyObservers [nsObserverList.cpp : 99 + 0x12]
    rbx = 0x00000001   r12 = 0x00000000   r13 = 0xc941db55   r14 = 0x017a40f8
    r15 = 0x5be28970   rip = 0xc8b9860f   rsp = 0x5be28970   rbp = 0x5be289b0
    Found by: call frame info
12  libxul.so!nsObserverService::NotifyObservers [nsObserverService.cpp : 149 + 0x10]
    rbx = 0xc941db55   r12 = 0x017a40f8   r13 = 0x00000000   r14 = 0x018f9d20
    r15 = 0x5be28ea0   rip = 0xc8b989fb   rsp = 0x5be289c0   rbp = 0x5be289e0
    Found by: call frame info
13  libxul.so!mozilla::ShutdownXPCOM [nsXPComInit.cpp : 581 + 0x19]
    rbx = 0x00000000   r12 = 0x5be28a00   r13 = 0x5be28a40   r14 = 0x00000000
    r15 = 0x5be28ea0   rip = 0xc8b8962e   rsp = 0x5be289f0   rbp = 0x5be28ac0
    Found by: call frame info
14  xpcshell!main [xpcshell.cpp : 1957 + 0x6]
    rbx = 0x5be28c40   r12 = 0x01ad8360   r13 = 0x00000000   r14 = 0x5be28be0
    r15 = 0x5be28ea0   rip = 0x004090c2   rsp = 0x5be28ad0   rbp = 0x5be28d80
    Found by: call frame info

Comment 1

[Ed Morley [:emorley]]

Resolving WFM keyword:intermittent-failure bugs last modified >3 months ago, whose whiteboard contains none of:
{random,disabled,marked,fuzzy,todo,fails,failing,annotated,time-bomb,leave open}

There will inevitably be some false positives; for that (and the bugspam) I apologise. Filter on orangewfm.