Bugzilla@Mozilla – Bug 439206
[FIX]Shutdown crash [@ PL_DHashTableFinish] with high surrogate in <style>
Last modified: 2009-06-08 13:13:33 PDT
Summon comment box
Created attachment 325076 [details] testcase (makes Firefox crash on shutdown) Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9.1a1pre) Gecko/2008061310 Minefield/3.1a1pre Loading the testcase and then quitting Firefox (Cmd+Q) usually results in a crash: * PL_DHashTableFinish calling a random address * PL_DHashTableFinish calling AtomTableClearEntry, which dereferences a random address The problem clearly starts with bug 316338, but I think there's a recent regression in how the style system or the atom table deals with it.
I'm hitting this crash frequently enough that it interferes with fuzzing.
jst, can you look at this?
Created attachment 336544 [details] [review] Fix The issue was that we added the atom to the table with one hashcode (as computed via HashCodeAsUTF8) but tried to remove it using the hashcode of the UTF-8 string stored in the atom when the atom went away. These should be the same, but there was a bug in HashCodeAsUTF8 that caused them to differ in the missing-low-surrogate case, which left a pointer to the dead atom in the atom table, and hence a shutdown crash. This patch just fixes that bug, making this code consistent with what the ConvertUTF16toUTF8 function and the UTF16CharEnumerator do. We probably want this patch on 1.9.0.x.
Pushed changeset a06a5b54d548.
Comment on attachment 336544 [details] [review] Fix Approved for 1.9.0.3, a=dveditz for release-drivers
Fixed on branch.
I cannot get 3.0.3 to crash with this test case on either OS X or Windows XP. How reliable is the crash?
It was about every other time or so for me on trunk with a debug build... I suspect opt builds it would happen less commonly.
Seeing as there hasn't been any discussions about this bug for 5 1/2 months and it's been in mochitest for that long, I'm assuming there aren't any residual issues. I'm moving this to verified as a result. If anyone has any qualms, feel free to bring them up.
You can verify this with a debug build, per comment 8.
I verified this for 1.9.0 using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10pre) Gecko/2009040612 Minefield/3.0.10pre (my own debug build from last week).