Closed Bug 859414 Opened 8 years ago Closed 8 years ago

Intermittent test_refetchManifest.html | application crashed [@ PL_DHashTableEnumerate] after Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0

Categories

(Core :: Networking: Cache, defect)

x86
Windows 8
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: RyanVM, Unassigned)

References

Details

(Keywords: assertion, crash, intermittent-failure)

Crash Data

+++ This bug was initially created as a clone of Bug #857540 +++

+++ This bug was initially created as a clone of Bug #857303 +++

+++ This bug was initially created as a clone of Bug #855793 +++

+++ This bug was initially created as a clone of Bug #855185 +++

Out of room in the summary.

https://tbpl.mozilla.org/php/getParsedLog.php?id=21549968&tree=Mozilla-Inbound
(Chris Pearce (:cpearce) on similar bug 857540, comment 3)
> OggCodecState's use of a hash table isn't threadsafe, I this crash may be a
> consequence of that.
https://tbpl.mozilla.org/php/getParsedLog.php?id=21550240&tree=Mozilla-Inbound
Summary: Intermittent test_refetchManifest.html | application crashed [@ PL_DHashTableEnumerate] after Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0 → Intermittent test_refetchManifest.html,test_bug671906.html | application crashed [@ PL_DHashTableEnumerate] after Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0
This bug has nothing to do with the Ogg decoder's hash table, the hash table in the stack in the tbpl log above is being used by the nsHttpConnectionMgr.
Component: Video/Audio → Networking: HTTP
Crash Signature: [@ PL_DHashTableOperate | nsTHashtable<nsBaseHashtableET<nsUint32HashKey,nsAutoPtr<mozilla::OggCodecState> > >::GetEntry(unsigned int const &)] → [@ PL_DHashTableOperate | nsTHashtable<nsBaseHashtableET<nsUint32HashKey,nsAutoPtr<mozilla::OggCodecState> > >::GetEntry(unsigned int const&)]
Those two failures are completely different and the crash signature field was bogus.
Broke out the second one as bug 859744.


https://tbpl.mozilla.org/php/getParsedLog.php?id=21549968&full=1&branch=mozilla-inbound

10:37:12     INFO -  Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0, at e:/builds/moz2_slave/m-in-w32-d-0000000000000000000/build/obj-firefox/xpcom/build/pldhash.cpp:668

[...]

10:37:20  WARNING -  PROCESS-CRASH | /tests/dom/tests/mochitest/ajax/offline/test_refetchManifest.html | application crashed [@ PL_DHashTableOperate]
10:37:20     INFO -  Crash dump filename: c:\users\cltbld~1.t-w\appdata\local\temp\tmpl69mup\minidumps\1e8c8ea2-9601-49f9-b973-5a92483aa9d9.dmp
10:37:20     INFO -  Operating system: Windows NT
10:37:20     INFO -                    6.2.9200
10:37:20     INFO -  CPU: x86
10:37:20     INFO -       GenuineIntel family 6 model 30 stepping 5
10:37:20     INFO -       8 CPUs
10:37:20     INFO -  Crash reason:  EXCEPTION_BREAKPOINT
10:37:20     INFO -  Crash address: 0x7210109a
10:37:20     INFO -  Thread 17 (crashed)
10:37:20     INFO -   0  xul.dll!PL_DHashTableOperate [pldhash.cpp:bbdc376f08fe : 668 + 0x51]
10:37:20     INFO -      eip = 0x7210109a   esp = 0x09f0fd54   ebp = 0x09f0fd64   ebx = 0x183f53a0
10:37:20     INFO -      esi = 0x6f7e1440   edi = 0x115d02b8   eax = 0x00000000   ecx = 0xc17afa10
10:37:20     INFO -      edx = 0x6f8de4d8   efl = 0x00000212
10:37:20     INFO -      Found by: given as instruction pointer in context
10:37:20     INFO -   1  xul.dll!nsTHashtable<nsBaseHashtableET<nsCStringHashKey,nsAutoPtr<nsCString> > >::GetEntry(nsACString_internal const &) [nsTHashtable.h:bbdc376f08fe : 148 + 0xb]
10:37:20     INFO -      eip = 0x70a292a3   esp = 0x09f0fd6c   ebp = 0x09f0fd74
10:37:20     INFO -      Found by: call frame info
10:37:20     INFO -   2  xul.dll!nsClassHashtable<nsCStringHashKey,nsCString>::Get(nsACString_internal const &,nsCString * *) [nsClassHashtable.h:bbdc376f08fe : 63 + 0x7]
10:37:20     INFO -      eip = 0x70a2bb9c   esp = 0x09f0fd7c   ebp = 0x09f0fd80
10:37:20     INFO -      Found by: call frame info
10:37:20     INFO -   3  xul.dll!nsOfflineCacheDevice::IsActiveCache(nsACString_internal const &,nsACString_internal const &) [nsDiskCacheDeviceSQL.cpp:bbdc376f08fe : 2617 + 0x11]
10:37:20     INFO -      eip = 0x70a2c969   esp = 0x09f0fd88   ebp = 0x09f0fd94
10:37:20     INFO -      Found by: call frame info
10:37:20     INFO -   4  xul.dll!nsOfflineCacheDiscardCache::Run() [nsDiskCacheDeviceSQL.cpp:bbdc376f08fe : 253 + 0x1e]
10:37:20     INFO -      eip = 0x70a2dae9   esp = 0x09f0fd9c   ebp = 0x09f0fdb0
10:37:20     INFO -      Found by: call frame info
10:37:20     INFO -   5  xul.dll!nsThread::ProcessNextEvent(bool,bool *) [nsThread.cpp:bbdc376f08fe : 627 + 0xd]
10:37:20     INFO -      eip = 0x7215a4a4   esp = 0x09f0fdb8   ebp = 0x09f0fe08
10:37:20     INFO -      Found by: call frame info
10:37:20     INFO -   6  xul.dll!NS_ProcessNextEvent(nsIThread *,bool) [nsThreadUtils.cpp:bbdc376f08fe : 238 + 0xc]
10:37:20     INFO -      eip = 0x720ff221   esp = 0x09f0fe10   ebp = 0x09f0fe1c
10:37:20     INFO -      Found by: call frame info
10:37:20     INFO -   7  xul.dll!nsThread::ThreadFunc(void *) [nsThread.cpp:bbdc376f08fe : 265 + 0x7]
10:37:20     INFO -      eip = 0x72159a42   esp = 0x09f0fe24   ebp = 0x09f0fe44
10:37:20     INFO -      Found by: call frame info
10:37:20     INFO -   8  nss3.dll!_PR_NativeRunThread [pruthr.c:bbdc376f08fe : 395 + 0x8]
10:37:20     INFO -      eip = 0x6facc49b   esp = 0x09f0fe4c   ebp = 0x09f0fea4
10:37:20     INFO -      Found by: call frame info
10:37:20     INFO -   9  nss3.dll!pr_root [w95thred.c:bbdc376f08fe : 90 + 0xc]
10:37:20     INFO -      eip = 0x6fad35ed   esp = 0x09f0fe68   ebp = 0x09f0fea4
10:37:20     INFO -      Found by: call frame info
10:37:20     INFO -  10  MSVCR100D.dll + 0x4a292
10:37:20     INFO -      eip = 0x6f7ca293   esp = 0x09f0fe70   ebp = 0x09f0fea4
10:37:20     INFO -      Found by: call frame info
10:37:20     INFO -  11  MSVCR100D.dll + 0x4a223
10:37:20     INFO -      eip = 0x6f7ca224   esp = 0x09f0feac   ebp = 0x09f0feb0
10:37:20     INFO -      Found by: previous frame's frame pointer
10:37:20     INFO -  12  kernel32.dll + 0x28542
10:37:20     INFO -      eip = 0x76a98543   esp = 0x09f0feb8   ebp = 0x09f0febc
10:37:20     INFO -      Found by: previous frame's frame pointer
10:37:20     INFO -  13  ntdll.dll + 0x5ac68
10:37:20     INFO -      eip = 0x76f5ac69   esp = 0x09f0fec4   ebp = 0x09f0ff00
10:37:20     INFO -      Found by: previous frame's frame pointer
10:37:20     INFO -  14  ntdll.dll + 0x5ac3b
10:37:20     INFO -      eip = 0x76f5ac3c   esp = 0x09f0ff08   ebp = 0x09f0ff18
10:37:20     INFO -      Found by: previous frame's frame pointer
No longer blocks: 859744
Crash Signature: [@ PL_DHashTableOperate | nsTHashtable<nsBaseHashtableET<nsUint32HashKey,nsAutoPtr<mozilla::OggCodecState> > >::GetEntry(unsigned int const&)] → [@ PL_DHashTableOperate | nsTHashtable<nsBaseHashtableET<nsCStringHashKey,nsAutoPtr<nsCString> > >::GetEntry(nsACString_internal const &) | nsClassHashtable<nsCStringHashKey,nsCString>::Get(nsACString_internal const &,nsCString * *) | nsOfflineCacheDevi…
Component: Networking: HTTP → Networking: Cache
OS: Windows XP → Windows 8
Priority: P2 → --
Summary: Intermittent test_refetchManifest.html,test_bug671906.html | application crashed [@ PL_DHashTableEnumerate] after Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0 → Intermittent test_refetchManifest.html | application crashed [@ PL_DHashTableEnumerate] after Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0
nsTHashtable is not in the skiplist (see https://github.com/mozilla/socorro/blob/master/scripts/config/processorconfig.py.dist).
Socorro remove spaces before & or *.
Crash Signature: [@ PL_DHashTableOperate | nsTHashtable<nsBaseHashtableET<nsCStringHashKey,nsAutoPtr<nsCString> > >::GetEntry(nsACString_internal const &) | nsClassHashtable<nsCStringHashKey,nsCString>::Get(nsACString_internal const &,nsCString * *) | nsOfflineCacheDevi… → [@ PL_DHashTableOperate | nsTHashtable<nsBaseHashtableET<nsCStringHashKey,nsAutoPtr<nsCString> > >::GetEntry(nsACString_internal const&)]
(In reply to Scoobidiver from comment #5)
> nsTHashtable is not in the skiplist (see
> https://github.com/mozilla/socorro/blob/master/scripts/config/
> processorconfig.py.dist).
> Socorro remove spaces before & or *.

Hm, so is there any documentation or write-up on what to watch out for with the crash signature field?
(In reply to Georg Fritzsche [:gfritzsche] from comment #6)
> Hm, so is there any documentation or write-up on what to watch out for with
> the crash signature field?

The usual rule is "whatever Socorro puts into the signature is being used here" as the main reason for the Crash Signature field is for Socorro to be able to link bugs from crash-stats.mozilla.com
https://tbpl.mozilla.org/php/getParsedLog.php?id=22036093&tree=Mozilla-Inbound
Summary: Intermittent test_refetchManifest.html | application crashed [@ PL_DHashTableEnumerate] after Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0 → Intermittent test_refetchManifest.html,test_streamNotify.html | application crashed [@ PL_DHashTableEnumerate] after Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0
(In reply to Phil Ringnalda (:philor) from comment #9)
> https://tbpl.mozilla.org/php/getParsedLog.php?id=22036093&tree=Mozilla-
> Inbound

That one is in the HttpManager, not the cache, and with a PL_DHashTableOperate crash signature.

Adding to bug 859744.
Summary: Intermittent test_refetchManifest.html,test_streamNotify.html | application crashed [@ PL_DHashTableEnumerate] after Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0 → Intermittent test_refetchManifest.html | application crashed [@ PL_DHashTableEnumerate] after Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0
Possibly fixed by bug 855185?
(In reply to Ryan VanderMeulen [:RyanVM] from comment #12)
> Possibly fixed by bug 855185?

probably.. hard to know for certain since the offending thread isn't on the stack when it is caught. but its consistent with 855185
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Frankly, as muddied up as these bugs got by the various stacks, I'm perfectly fine with just resolving these bugs optimistically and filing new ones as they pop up so we can better track them all.
855185 also added some new related asserts to the necko code.. so if there is a still an offender out there they would likely generate a different (but more easily actionable!) stack.
You need to log in before you can comment on or make changes to this bug.