439206 - [FIX]Shutdown crash [@ PL_DHashTableFinish] with high surrogate in <style>

Status: RESOLVED FIXED

(Core :: XPCOM, defect, P1)

Description

[Jesse Ruderman]

Attachment: testcase (makes Firefox crash on shutdown)

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9.1a1pre) Gecko/2008061310 Minefield/3.1a1pre

Loading the testcase and then quitting Firefox (Cmd+Q) usually results in a crash:

* PL_DHashTableFinish calling a random address
* PL_DHashTableFinish calling AtomTableClearEntry, which dereferences a random address

The problem clearly starts with bug 316338, but I think there's a recent regression in how the style system or the atom table deals with it.

Comment 1

[Jesse Ruderman]

I'm hitting this crash frequently enough that it interferes with fuzzing.

Comment 2

[Jesse Ruderman]

jst, can you look at this?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

The issue was that we added the atom to the table with one hashcode (as computed via HashCodeAsUTF8) but tried to remove it using the hashcode of the UTF-8 string stored in the atom when the atom went away.  These should be the same, but there was a bug in HashCodeAsUTF8 that caused them to differ in the missing-low-surrogate case, which left a pointer to the dead atom in the atom table, and hence a shutdown crash.

This patch just fixes that bug, making this code consistent with what the ConvertUTF16toUTF8 function and the UTF16CharEnumerator do.

We probably want this patch on 1.9.0.x.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Pushed changeset a06a5b54d548.

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 336544 [details] [diff] [review]
Fix

Approved for 1.9.0.3, a=dveditz for release-drivers

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed on branch.

Comment 7

[Al Billings [:abillings - ex-MoCo]]

I cannot get 3.0.3 to crash with this test case on either OS X or Windows XP. How reliable is the crash?

Comment 8

[Boris Zbarsky [:bzbarsky]]

It was about every other time or so for me on trunk with a debug build...  I suspect opt builds it would happen less commonly.

Comment 9

[Aakash Desai [:aakashd]]

Seeing as there hasn't been any discussions about this bug for 5 1/2 months and it's been in mochitest for that long, I'm assuming there aren't any residual issues. I'm moving this to verified as a result. If anyone has any qualms, feel free to bring them up.

Comment 10

[Samuel Sidler (old account; do not CC)]

You can verify this with a debug build, per comment 8.

Comment 11

[Al Billings [:abillings - ex-MoCo]]

I verified this for 1.9.0 using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10pre) Gecko/2009040612 Minefield/3.0.10pre (my own debug build from last week).