251506 - Browser crashes when using "Sort Bookmarks 0.51" extension with "Add Bookmark Here 0.5" extension installed [@ nsXULContentBuilder::RemoveGeneratedContent ]

Status: RESOLVED FIXED

(Firefox :: Bookmarks & History, defect, P3)

Description

[Allan]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2

I have both the "Sort Bookmarks 0.51" and the "Add Bookmarks Here 0.5:
extensions installed in Mozilla Firefox 9.2.  As well I imported my bookmarks
from IE.

Whenever I go to sort the imported bookmarks Firefox crashes and I get an error
saying that Firefox has encountered problems and had to close.  However, if I
remove the "Add Bookmarks Here" extension and do a sort it sorts just fine.

  



Reproducible: Always
Steps to Reproduce:
1. Install both "Add Bookmarks Here 0.5" and "Sort Bookmarks 0.51" extensions.
2. Try and sort imported IE bookmarks.
3. Firefox crashes every time I tried it (I tried it at least a dozen times).

Actual Results:  
Firefox crashes and generates and error message.  Without the "Add Bookmarks
Here" extension the bookmarks do sort properly every time yet with the extension
the browser crashs every time I try and sort.

Expected Results:  
Bookmarks should have sorted without crashing browser.

Comment 1

[Adam Hauner]

Allan: Could you provide TalkBack incident ID?

Comment 2

[Allan]

After further testing I noticed that it only seems to crash when I am sorting 
within the folders on my bookmark list.  I have all of my bookmarks sorted 
according to categories and such and when I go and sort the contents of any 
folder the browser crashes every single time (about 15 times now - everytime I 
click the "sort" button).  I only had it crash once when sorting bookmarks in 
the main list though (outside of any folders). 

Comment 3

[Allan]

TalkBack ID: TB332811Z

Comment 4

[Adam Hauner]

TB332811Z:
nsXULContentBuilder::RemoveGeneratedContent 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp,
line 1395]
nsXULContentBuilder::RebuildAll 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp,
line 1943]
nsXULTemplateBuilder::Rebuild 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp,
line 238]

Boris, you have fixed bug 221494 with similar stack. Interested?

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

I'm able to reproduce it on linux with a 0713 nightly as well; if bz doesn't
want it, I'll take it.  Fresh profile, install the two extensions referenced, go
into any folder and right-click sort bookmarks on a bookmark item.  From the
type of crash, I thought it might be related to bug 250276, since it only occurs
when you right-click sort on a bookmark item (causing that item to get sorted
itself), and not on a folder.

Comment 6

[chris hofmann]

jay, can you search talkback data to  see if you can help isolate where this is
happening?

Comment 7

[Jay Patel [:jay]]

All crashes with this stack signature are currently on Windows 2K/XP:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=+nsXULContentBuilder%3A%3ARemoveGeneratedContent&vendor=All&product=All&platform=All&buildid=&sdate=&stime=00%3A00%3A00&edate=&etime=23%3A59%3A59

There seem to be other crashes with different stack signatures that still
mention the sort bookmarks extension in the comments though:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=comments&match=contains&searchfor=sort+book&vendor=All&product=All&platform=All&buildid=&sdate=&stime=00%3A00%3A00&edate=&etime=23%3A59%3A59

Vladimir:  Did you submit a Talkback incident for your crash on Linux?  It'll be
nice to see how your stack signature is different from the Windows crashes...but
if you're already on top of this, don't worry about it.

Comment 8

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

I didn't, but I'm tackling this now.  The crash is being caused by the sort
bookmarks extension doing something that gets the template builder very
confused, but only if the add bookmarks extension is installed -- I'm working on
figuring out what add bm here is doing.  For reference, here's my stack trace
(the js_Invoke in frame #17 or so is in the sort-bookmarks function that does
the sorting).

#3  0x08070e92 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:135
#4  0x08071ba9 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:209
#5  <signal handler called>
#6  0x01793f76 in nsXULContentBuilder::RemoveGeneratedContent (this=0x8e9a130, 
    aElement=0x8ed0c08)
    at ../../../../../mozilla/content/xul/templates/src/nsXULContentBuilder.cpp:
                                                                               
              1395
#7  0x01795ce5 in nsXULContentBuilder::RebuildAll (this=0x8e9a130)
    at ../../../../../mozilla/content/xul/templates/src/nsXULContentBuilder.cpp:
                                                                               
              1942
#8  0x017aa3cf in nsXULTemplateBuilder::Rebuild (this=0x8e9a130)
    at ../../../../../mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp
                                                                               
              :238
#9  0x017ab552 in nsXULTemplateBuilder::OnEndUpdateBatch (this=0x8e9a130, 
    aDataSource=0x8e9c210)
    at ../../../../../mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp
                                                                               
              :645
#10 0x043f34f4 in CompositeDataSourceImpl::OnEndUpdateBatch (this=0x8e9c210, 
    aDataSource=0x8e89d1c)
    at ../../../../mozilla/rdf/base/src/nsCompositeDataSource.cpp:1562
#11 0x0299193e in nsBookmarksService::OnEndUpdateBatch (this=0x8e89d18, 
    aDataSource=0x8ea0ef8)
    at ../../../../../mozilla/browser/components/bookmarks/src/nsBookmarksServic
                                                                               
              e.cpp:5456
#12 0x043fbdec in InMemoryDataSource::EndUpdateBatch (this=0x8ea0ef8)
    at ../../../../mozilla/rdf/base/src/nsInMemoryDataSource.cpp:1884
#13 0x0299c8ee in nsBookmarksService::EndUpdateBatch (this=0x8e89d18)
    at nsBookmarksService.h:293
#14 0x00225339 in XPTC_InvokeByIndex ()
    at ../../../../../../../mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke
                                                                               
              _gcc_x86_unix.cpp:69
#15 0x04efa92b in XPCWrappedNative::CallMethod (ccx=@0xfef97dd0, 
    mode=CALL_METHOD)
    at ../../../../../mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2027
#16 0x04f04aab in XPC_WN_CallMethod (cx=0x8cf1608, obj=0x9070368, argc=0, 
    argv=0x917f95c, vp=0xfef97f80)
    at ../../../../../mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:128
                                                                               
              7
#17 0x00ca0f19 in js_Invoke (cx=0x8cf1608, argc=0, flags=0)
    at ../../../mozilla/js/src/jsinterp.c:941
#18 0x00caf15d in js_Interpret (cx=0x8cf1608, result=0xfef9853c)
    at ../../../mozilla/js/src/jsinterp.c:2972
#19 0x00ca0f93 in js_Invoke (cx=0x8cf1608, argc=1, flags=2)
    at ../../../mozilla/js/src/jsinterp.c:958
#20 0x00ca1309 in js_InternalInvoke (cx=0x8cf1608, obj=0x910e088, 
    fval=152102072, flags=0, argc=1, argv=0xfef988d8, rval=0xfef98784)
    at ../../../mozilla/js/src/jsinterp.c:1035
#21 0x00c7074c in JS_CallFunctionValue (cx=0x8cf1608, obj=0x910e088, 
    fval=152102072, argc=1, argv=0xfef988d8, rval=0xfef98784)
    at ../../../mozilla/js/src/jsapi.c:3673
#22 0x016e51ff in nsJSContext::CallEventHandler (this=0x8cf6748, 
    aTarget=0x910e088, aHandler=0x910e4b8, argc=1, argv=0xfef988d8, 
    rval=0xfef98784)
    at ../../../../mozilla/dom/src/base/nsJSEnvironment.cpp:1296
#23 0x017401a8 in nsJSEventListener::HandleEvent (this=0x9224f88, 
    aEvent=0x90e7070)
    at ../../../../mozilla/dom/src/events/nsJSEventListener.cpp:174
#24 0x0151de05 in nsEventListenerManager::HandleEventSubType (this=0x9225070, 
    aListenerStruct=0x92250d8, aDOMEvent=0x90e7070, aCurrentTarget=0x90e70d0, 
    aSubType=8, aPhaseFlags=7)
    at ../../../../mozilla/content/events/src/nsEventListenerManager.cpp:1434
#25 0x0151e189 in nsEventListenerManager::HandleEvent (this=0x9225070, 
    aPresContext=0x8ce2dc8, aEvent=0xfef98e90, aDOMEvent=0xfef98dcc, 
    aCurrentTarget=0x90e70d0, aFlags=7, aEventStatus=0xfef98e7c)
    at ../../../../mozilla/content/events/src/nsEventListenerManager.cpp:1525
#26 0x01770e49 in nsXULElement::HandleDOMEvent (this=0x9224eb8, 
    aPresContext=0x8ce2dc8, aEvent=0xfef98e90, aDOMEvent=0xfef98dcc, aFlags=7, 
    aEventStatus=0xfef98e7c)
    at ../../../../../mozilla/content/xul/content/src/nsXULElement.cpp:2840
#27 0x012eb076 in PresShell::HandleDOMEventWithTarget (this=0x8c64628, 
    aTargetContent=0x9224eb8, aEvent=0xfef98e90, aStatus=0xfef98e7c)
    at ../../../../../mozilla/layout/html/base/src/nsPresShell.cpp:6082
#28 0x013f77d9 in nsMenuFrame::Execute (this=0x8d7b724, aEvent=0xfef993f0)
    at ../../../../../mozilla/layout/xul/base/src/nsMenuFrame.cpp:1670
#29 0x013f3061 in nsMenuFrame::HandleEvent (this=0x8d7b724, 
    aPresContext=0x8ce2dc8, aEvent=0xfef993f0, aEventStatus=0xfef99288)
    at ../../../../../mozilla/layout/xul/base/src/nsMenuFrame.cpp:455
#30 0x012eaf1a in PresShell::HandleEventInternal (this=0x8c64628, 
    aEvent=0xfef993f0, aView=0x916c278, aFlags=1, aStatus=0xfef99288)
    at ../../../../../mozilla/layout/html/base/src/nsPresShell.cpp:6049
#31 0x012ea71f in PresShell::HandleEvent (this=0x8c64628, aView=0x916c278, 
    aEvent=0xfef993f0, aEventStatus=0xfef99288, aForceHandle=0, 
    aHandled=@0xfef99218)
    at ../../../../../mozilla/layout/html/base/src/nsPresShell.cpp:5898
#32 0x016d8f0d in nsViewManager::HandleEvent (this=0x8c63f78, aView=0x9179878, 
    aEvent=0xfef993f0, aCaptured=0)
    at ../../../mozilla/view/src/nsViewManager.cpp:2283
#33 0x016d84a8 in nsViewManager::DispatchEvent (this=0x8c63f78, 
    aEvent=0xfef993f0, aStatus=0xfef993a0)
    at ../../../mozilla/view/src/nsViewManager.cpp:2025
#34 0x016cdae0 in HandleEvent (aEvent=0xfef993f0)
    at ../../../mozilla/view/src/nsView.cpp:76
#35 0x04d8f243 in nsCommonWidget::DispatchEvent (this=0x91798f8, 
    aEvent=0xfef993f0, aStatus=@0xfef993ec)
    at ../../../../mozilla/widget/src/gtk2/nsCommonWidget.cpp:215
#36 0x04d80a09 in nsWindow::OnButtonReleaseEvent (this=0x91798f8, 
    aWidget=0x91707f8, aEvent=0x8d0ea18)
    at ../../../../mozilla/widget/src/gtk2/nsWindow.cpp:1449
#37 0x04d84fbb in button_release_event_cb (widget=0x91707f8, event=0x8d0ea18)
    at ../../../../mozilla/widget/src/gtk2/nsWindow.cpp:3274
...

Comment 9

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: contentbuilder-crash-bandaid-0.patch

OK; the problem here is that the sort bookmarks extension is triggering a
RebuildAll because it uses BeginUpdateBatch/EndUpdateBatch (as it should). 
However, for bookmarks menus, we have onshowing/onhiding callbacks that take
care of adding and removing things like the "Open in tabs" menu item; Add
Bookmarks Here overwrites those callbacks and adds its own to show its own
menu.

When the RebuildAll is triggered, those additional menu elements are tripping
up the content builder when it tries to remove generated content.  ABH just
confuses the problem even more, because it adds elements in a timeout (I don't
know why).

This bandaid patch seems to fix the symptoms, and I don't see any immediate ill
effects from it.

Comment 10

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

*** Bug 221500 has been marked as a duplicate of this bug. ***

Comment 11

[Ben Goodger (use ben at mozilla dot org for email)]

Comment on attachment 155030 [details] [diff] [review]
contentbuilder-crash-bandaid-0.patch

r/a=[e-mail]

Comment 12

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

in on aviary, might not be the type of bandaid we want on trunk.  resolving to
get off PR1 list.

Comment 13

[Mike Connor [:mconnor]]

sorry for bugspam, long-overdue mass reassign of ancient QA contact bugs, filter on "beltznerLovesGoats" to get rid of this mass change