Bug 153777 – Crash in WTF::HashTable ... remove()

• Component: Web Template Framework
• Status: NEW

[Stefan Arentz]

Created attachment 270443 [details]
Full crash log

Incident Identifier: 7D33106A-1D0C-4C7F-B307-13158624AF6F
CrashReporter Key:   c8ffe2c1c066882b3bcce0002c28a1c59f447d42
Hardware Model:      iPhone7,2
Process:             Client [559]
Path:                /private/var/mobile/Containers/Bundle/Application/9DD11C81-85AF-43CA-8E39-96637BCD308F/Client.app/Client
Identifier:          org.mozilla.ios.Firefox
Version:             1405 (1.4)
Code Type:           ARM-64 (Native)
Parent Process:      launchd [1]

Date/Time:           2016-01-28 06:23:47.865 +0100
Launch Time:         2016-01-28 06:10:30.239 +0100
OS Version:          iOS 8.4 (12H143)
Report Version:      105

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x7b0ed2e331ee0dd3
Triggered by Thread:  9

Thread 9 name:
Thread 9 Crashed:
0   WebKit                        	0x000000018b1f0e90 WTF::HashTable<IPC::StringReference, WTF::KeyValuePair<IPC::StringReference, std::__1::pair<WTF::RefPtr<WorkQueue>, WTF::RefPtr<IPC::Connection::WorkQueueMessageReceiver> > >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<IPC::StringReference, std::__1::pair<WTF::RefPtr<WorkQueue>, WTF::RefPtr<IPC::Connection::WorkQueueMessageReceiver> > > >, IPC::StringReference::Hash, WTF::HashMap<IPC::StringReference, std::__1::pair<WTF::RefPtr<WorkQueue>, WTF::RefPtr<IPC::Connection::WorkQueueMessageReceiver> >, IPC::StringReference::Hash, WTF::HashTraits<IPC::StringReference>, WTF::HashTraits<std::__1::pair<WTF::RefPtr<WorkQueue>, WTF::RefPtr<IPC::Connection::WorkQueueMessageReceiver> > > >::KeyValuePairTraits, WTF::HashTraits<IPC::StringReference> >::remove(WTF::KeyValuePair<IPC::StringReference, std::__1::pair<WTF::RefPtr<WorkQueue>, WTF::RefPtr<IPC::Connection::WorkQueueMessageReceiver> > >*) + 72 (ThreadSafeRefCounted.h:112)
1   WebKit                        	0x000000018b1f0e2c WTF::HashMap<IPC::StringReference, std::__1::pair<WTF::RefPtr<WorkQueue>, WTF::RefPtr<IPC::Connection::WorkQueueMessageReceiver> >, IPC::StringReference::Hash, WTF::HashTraits<IPC::StringReference>, WTF::HashTraits<std::__1::pair<WTF::RefPtr<WorkQueue>, WTF::RefPtr<IPC::Connection::WorkQueueMessageReceiver> > > >::remove(IPC::StringReference const&) + 52 (HashTable.h:971)
2   WebKit                        	0x000000018b1f0e2c WTF::HashMap<IPC::StringReference, std::__1::pair<WTF::RefPtr<WorkQueue>, WTF::RefPtr<IPC::Connection::WorkQueueMessageReceiver> >, IPC::StringReference::Hash, WTF::HashTraits<IPC::StringReference>, WTF::HashTraits<std::__1::pair<WTF::RefPtr<WorkQueue>, WTF::RefPtr<IPC::Connection::WorkQueueMessageReceiver> > > >::remove(IPC::StringReference const&) + 52 (HashTable.h:971)
3   WebKit                        	0x000000018b3d8be4 ___ZN9WorkQueue8dispatchENSt3__18functionIFvvEEE_block_invoke + 28 (functional:1755)
4   libdispatch.dylib             	0x0000000198085990 _dispatch_call_block_and_release + 20 (init.c:731)
5   libdispatch.dylib             	0x0000000198085950 _dispatch_client_callout + 12 (object.m:489)
6   libdispatch.dylib             	0x00000001980900a0 _dispatch_queue_drain + 1444 (inline_internal.h:954)
7   libdispatch.dylib             	0x0000000198088a58 _dispatch_queue_invoke + 128 (queue.c:3566)
8   libdispatch.dylib             	0x0000000198092314 _dispatch_root_queue_drain + 716 (inline_internal.h:934)
9   libdispatch.dylib             	0x0000000198093c48 _dispatch_worker_thread3 + 104 (atomic_llsc.h:4869)
10  libsystem_pthread.dylib       	0x0000000198265228 _pthread_wqthread + 812 (pthread.c:1941)
11  libsystem_pthread.dylib       	0x0000000198264eec start_wqthread + 0 (pthread_asm.s:181)

[Alexey Proskuryakov]

Is this reproducible, or a random crash found in logs?

[Stefan Arentz]

Not reproducible. But it is a top crasher for Firefox for iOS. Not sure what triggers it, but it is significant enough to show up relatively high in our crash stats.