877562 - Intermittent test_identicalManifest.html| application crashed [@ PL_DHashTableOperate] after "Assertion failure: op == PL_DHASH_LOOKUP || (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) == 0"

Status: RESOLVED FIXED

(Core :: Preferences: Backend, defect)

Description

[Randell Jesup [:jesup] (needinfo me)]

+++ This bug was initially created as a clone of Bug #864705 +++

+++ This bug was initially created as a clone of Bug #859744 +++

+++ This bug was initially created as a clone of Bug #859414 +++

Out of room in summary. 

https://tbpl.mozilla.org/php/getParsedLog.php?id=23554109&tree=Mozilla-Beta&full=1

16:13:10 INFO - Assertion failure: op == PL_DHASH_LOOKUP || (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) == 0, at e:/builds/moz2_slave/m-beta-w32-d-00000000000000000/build/obj-firefox/xpcom/build/pldhash.cpp:573
16:13:13 WARNING - TEST-UNEXPECTED-FAIL | /tests/dom/tests/mochitest/ajax/offline/test_identicalManifest.html | Exited with code -2147483645 during test run

Comment 1

[Legacy TBPL/Treeherder Robot]

philor
https://tbpl.mozilla.org/php/getParsedLog.php?id=23788605&tree=Mozilla-Inbound
Windows 7 32-bit mozilla-inbound debug test mochitest-3 on 2013-06-04 16:31:30
slave: t-w732-ix-119

16:50:12     INFO -  Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0, at e:/builds/moz2_slave/m-in-w32-d-0000000000000000000/build/obj-firefox/xpcom/build/pldhash.cpp:668
16:50:12  WARNING -  TEST-UNEXPECTED-FAIL | /tests/dom/tests/mochitest/ajax/offline/test_identicalManifest.html | Exited with code -2147483645 during test run
16:50:19  WARNING -  PROCESS-CRASH | /tests/dom/tests/mochitest/ajax/offline/test_identicalManifest.html | application crashed [@ PL_DHashTableOperate]
16:50:21    ERROR - Return code: 1

Comment 2

[Honza Bambas (:mayhemer)]

The hash table is accessed on multiple thread w/o a mutex.

I'll fix it.

Comment 3

[Legacy TBPL/Treeherder Robot]

RyanVM
https://tbpl.mozilla.org/php/getParsedLog.php?id=25892381&tree=Mozilla-Inbound
Windows XP 32-bit mozilla-inbound debug test mochitest-3 on 2013-07-29 19:43:17
revision: a0bc16b5a428
slave: t-xp32-ix-087

19:59:04     INFO -  Assertion failure: (*(uint32_t*)(table->entryStore + ((uint32_t)1 << (32 - (table)->hashShift)) * table->entrySize)) > 0, at e:/builds/moz2_slave/m-in-w32-d-0000000000000000000/build/obj-firefox/xpcom/build/pldhash.cpp:667
19:59:04     INFO -  Assertion failure: isEmpty(), at e:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\obj-firefox\dist\include\mozilla/LinkedList.h:269
19:59:04  WARNING -  TEST-UNEXPECTED-FAIL | /tests/dom/tests/mochitest/ajax/offline/test_identicalManifest.html | Exited with code -2147483645 during test run
19:59:12  WARNING -  PROCESS-CRASH | /tests/dom/tests/mochitest/ajax/offline/test_identicalManifest.html | application crashed [@ PL_DHashTableOperate]
19:59:13    ERROR - Return code: 1

Comment 4

[Honza Bambas (:mayhemer)]

https://tbpl.mozilla.org/?tree=Try&rev=60e80338b519

Comment 5

[Honza Bambas (:mayhemer)]

Attachment: v1

Try is green, I think we have a fix.

Comment 6

[Honza Bambas (:mayhemer)]

Comment on attachment 790157 [details] [diff] [review]
v1

https://hg.mozilla.org/integration/mozilla-inbound/rev/067bc81b7074

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/067bc81b7074

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Can you please request approval for uplift to aurora/beta?

Comment 9

[Honza Bambas (:mayhemer)]

Comment on attachment 790157 [details] [diff] [review]
v1

[Approval Request Comment]
Bug caused by (feature/regressing bug #): since ever
User impact if declined: concurrent thread memory access (hashtable operations) causing heap corruption leading to unpredictable crashes
Testing completed (on m-c, etc.): just landed on m-c
Risk to taking this patch (and alternatives if risky): this adds a new lock, I took care not to call foreign code under it, still it's a new lock that might introduce a deadlock (however, IMO low probability of it)
String or IDL/UUID changes made by this patch: none

Comment 10

[Honza Bambas (:mayhemer)]

(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #8)
> Can you please request approval for uplift to aurora/beta?

Done

Comment 11

[bhavana bajaj [:bajaj]]

(In reply to Honza Bambas (:mayhemer) from comment #9)
> Comment on attachment 790157 [details] [diff] [review]
> v1
> 
> [Approval Request Comment]
> Bug caused by (feature/regressing bug #): since ever
> User impact if declined: concurrent thread memory access (hashtable
> operations) causing heap corruption leading to unpredictable crashes
> Testing completed (on m-c, etc.): just landed on m-c
> Risk to taking this patch (and alternatives if risky): this adds a new lock,
> I took care not to call foreign code under it, still it's a new lock that
> might introduce a deadlock (however, IMO low probability of it)

Given the risk here I'll let it bake on nightly/aurora a couple of days in preparation for a beta uplift.
> String or IDL/UUID changes made by this patch: none

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/ebdb46e872e8

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/dcde9c1791a2